Merge pull request 'nixos-25.11' (#6) from nixos-25.11 into main

Reviewed-on: #6

.sops.yaml

@@ -1,38 +1,50 @@
 keys:
+  - &bw_recovery age146z3h3flw7spy5thznak8k5jh6yd68k9qrrehg8sdcwmyjv3vd7qvahdur
   - &host_burnham age12cgkgx8xac77q0rwakp6zrfrzp45mhk7wj6t3y8s0xurt3k879usnm66ct
   - &host_challenger age1j43eqpnq5hy6zt3gmdtzdnne2yfvccd832kpt69qavst44leec6sj2l773
   - &host_defiant age128md9emufxu35kgww3a90sw40vvc60f5xul9n9ndvw4lfnj3ndaqq44u64
-  - &host_voyager age14jzavfeg47pgnrstea6yzvh3s3a578nj8hkk8g79vxyzpn86gslscp23qu
-  - &user_felixalb age1nj7ju6f3jfvzw4c0sxywthjmztwp7rwqceun8xw2tlfrt7qymatser4vqf
+  - &host_morn age14ar8q5454khxxf5ur2nxwk533nzycz2lh3635qwz35wh8yq0jpqskj2ksx
+  - &user_felixalb_sisko age1phc4fkt25n4wtzg88sg3fhvmy6tv8pguyxp5c9js83ae3z374adsxfpqkl
+  - &user_felixalb_worf age1nj7ju6f3jfvzw4c0sxywthjmztwp7rwqceun8xw2tlfrt7qymatser4vqf
 
 creation_rules:
   # Global secrets
   - path_regex: secrets/[^/]+\.yaml$
     key_groups:
     - age:
-      - *user_felixalb
+      - *bw_recovery
+      - *user_felixalb_sisko
+      - *user_felixalb_worf
 
   # Host specific secrets
   - path_regex: secrets/burnham/[^/]+\.yaml$
     key_groups:
     - age:
       - *host_burnham
-      - *user_felixalb
+      - *bw_recovery
+      - *user_felixalb_sisko
+      - *user_felixalb_worf
 
   - path_regex: secrets/challenger/[^/]+\.yaml$
     key_groups:
     - age:
       - *host_challenger
-      - *user_felixalb
+      - *bw_recovery
+      - *user_felixalb_sisko
+      - *user_felixalb_worf
 
   - path_regex: secrets/defiant/[^/]+\.yaml$
     key_groups:
     - age:
       - *host_defiant
-      - *user_felixalb
+      - *bw_recovery
+      - *user_felixalb_sisko
+      - *user_felixalb_worf
 
-  - path_regex: secrets/voyager/[^/]+\.yaml$
+  - path_regex: secrets/morn/[^/]+\.yaml$
     key_groups:
     - age:
-      - *host_voyager
-      - *user_felixalb
+      - *host_morn
+      - *bw_recovery
+      - *user_felixalb_sisko
+      - *user_felixalb_worf

README.md

@@ -37,8 +37,9 @@ Other installed packages and tools are described in the config files (like ./hos
 ## Networking
 
 - I use *nginx* as a web server and reverse proxy. The configuration is mostly distributed throughout the services that use it ([example](https://git.feal.no/felixalb/nixos-config/src/commit/3a05681d10a6999f73cbef59c3999742b81947a6/hosts/defiant/services/hedgedoc.nix#L98)).
-- I recently switched from Tailscale(actually [headscale](https://github.com/juanfont/headscale)) to *WireGuard*, configured [here](./hosts/defiant/services/wireguard.nix) and [here](./hosts/burnham/services/wireguard.nix).
+- A long time ago, I switched from Tailscale(actually [headscale](https://github.com/juanfont/headscale)) to *WireGuard*, configured [here](./hosts/defiant/services/wireguard.nix).
 - PiHole ([source](./hosts/defiant/services/pihole.nix)) run my internal DNS (\*.home.feal.no) and ad blocking.
+- A simple custom DynDNS thing is defined [here](./common/domeneshop-dyndns.nix) and used [here](./hosts/defiant/services/dyndns.nix).
 
 ## Monitoring
 

base.nix

@@ -29,19 +29,12 @@
       trusted-users = [ "felixalb" ];
       builders-use-substitutes = true;
     };
-
-    registry= {
-      nixpkgs.flake = inputs.nixpkgs;
-    };
-
-    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
   };
 
   programs.zsh.enable = true;
 
   environment.systemPackages = with pkgs; [
     bottom
-    duf
     eza
     file
     git
@@ -61,10 +54,15 @@
     vim
     wget
     zip
+  ] ++ lib.optionals (pkgs.stdenv.isLinux) [
+    dmidecode
+    lm_sensors
+    pciutils
   ];
 
   services.openssh = {
     enable = true;
+    openFirewall = lib.mkDefault true;
     settings = {
       PermitRootLogin = "no";
       PasswordAuthentication = false;
@@ -78,20 +76,20 @@
     '';
   };
 
-  networking.firewall.allowedTCPPorts = [ 22 ];
+  programs.mosh.enable = true;
 
   users.users.felixalb = {
     isNormalUser = true;
-    extraGroups = lib.mkDefault [
+    extraGroups = [
       "wheel"
       "docker"
     ];
     uid = lib.mkDefault 1000;
     openssh.authorizedKeys.keys = lib.mkDefault [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDKzPICGew7uN0cmvRmbwkwTCodTBUgEhkoftQnZuO4Q felixalbrigtsen@gmail.com"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTXSL0w7OUcz1LzEt1T3I3K5RgyNV+MYz0x/1RbpDHQ felixalb@worf"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFiPHhj0YbklJnJNcxD0IlzPxLTGfv095H5zyS/1Wb64 felixalb@edison.home.feal.no"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDKzPICGew7uN0cmvRmbwkwTCodTBUgEhkoftQnZuO4Q felixalbrigtsen@gmail.com"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH5M7hYl3saBNMAo6sczgfUvASEJWFHuERB7xvf4gxst nix-builder-worf"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJky33ynjqyWP+hh24gFCMFIEqe3CjIIowGM9jiPbT79 felixalb@sisko.home.feal.no"
     ];
     shell = pkgs.zsh;
   };

common/auto-upgrade.nix

@@ -0,0 +1,15 @@
+{ config, pkgs, lib, ... }:
+
+{
+  system.autoUpgrade = {
+    enable = true;
+    flake = "git+https://git.feal.no/felixalb/nixos-config.git";
+    flags = [
+      # Override nixpkgs (only). Notably does not include home-manager, sops or other utility/application flake inputs.
+      "--refresh"
+      "--override-input" "nixpkgs" "github:NixOS/nixpkgs/nixos-25.11"
+      "--override-input" "nixpkgs-unstable" "github:nixos/nixpkgs/nixos-unstable"
+      "--no-write-lock-file"
+    ];
+  };
+}

common/pwndbg-gdb-alias.nix

@@ -0,0 +1,8 @@
+{ pwndbg }:
+
+# "$ coredumpctl gdb" always runs "gdb" from your path.
+pwndbg.overrideAttrs ({ installPhase ? "", ... }: {
+  installPhase = installPhase + ''
+    ln -s $out/bin/pwndbg $out/bin/gdb
+  '';
+})

common/securecrt.nix

@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  dpkg,
+
+  cups,
+  gtkmm3,
+  icu74,
+  krb5,
+  makeWrapper,
+  openssl,
+  pango,
+  python312,
+  xcb-util-cursor,
+  xorg,
+}:
+
+let
+  packageId = "scrt_ubuntu2464_deb_963";
+in stdenv.mkDerivation rec {
+  pname = "securecrt";
+  version = "9.6.3";
+
+  src = fetchurl {
+    url = "https://www.vandyke.com/cgi-bin/download_1.php";
+    name = "${pname}-${version}.deb";
+    curlOpts = "-X POST --data 'pid=${packageId}&export_check=accept&country=no&su";
+    sha256 = "sha256-PsFuxJ7H0rJCWWi+rvzrlRUJlp9R4MG14d883/kl9Lo=";
+  };
+
+  unpackCmd = "dpkg -x $curSrc source";
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    cups
+    gtkmm3
+    icu74
+    krb5
+    makeWrapper
+    openssl
+    pango
+    python312
+    xcb-util-cursor
+    xorg.xcbutilkeysyms
+    xorg.xcbutilwm
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+  dontWrapQTApps = true;
+
+  installPhase = ''
+    runhook preInstall
+
+    mkdir -p "$out"
+    cp -R usr/* "$out/"
+    wrapProgram "$out/bin/SecureCRT" --set QT_QPA_PLATFORM_PLUGIN_PATH "$out/lib/scrt/plugins/platforms"
+
+    runhook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.vandyke.com/products/securecrt/unix.html";
+    description = "Terminal emulator for computing professionals, with advanced session management";
+    license = {
+      free = false;
+      fullName = "Unknown / Custom";
+    };
+
+    platforms = with lib.platforms; linux ++ darwin ++ windows;
+    broken = !(stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64);
+  };
+
+  mainProgram = "SecureCRT";
+}

common/wireguard-peers.nix

@@ -0,0 +1,44 @@
+[
+  { # Sulu
+    publicKey = "j6YVekgGS4nhL5zUiOTeK2BVQkYGlTQaiUpwcqQyfRk=";
+    allowedIPs = [
+      "10.100.0.3/32"
+    ];
+  }
+  { # Worf
+    publicKey = "kW8SyzCh2tw8GzZV6bPn+IQVNUoUhseNfEm3rHnR1So=";
+    allowedIPs = [
+      "10.100.0.4/32"
+    ];
+  }
+  { # Phone
+    publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk=";
+    allowedIPs = [
+      "10.100.0.5/32"
+    ];
+  }
+  { # Riker
+    publicKey = "r715vpgH1H0zvN+Z5wcNKcOo5e6UM3fBfh9BZwTBjmA=";
+    allowedIPs = [
+      "10.100.0.6/32"
+    ];
+  }
+  { # fa-t14-2025
+    publicKey = "UPpUVWQqOKT65MFym1sFDTstNmuynDYE4LOOtbWqEng=";
+    allowedIPs = [
+      "10.100.0.7/32"
+    ];
+  }
+  { # Turtle
+    publicKey = "mDzAtRPv+O5TDHa9DGodF/KKuFXRBYwSqfPyeWfdfRI=";
+    allowedIPs = [
+      "10.100.0.8/32"
+    ];
+  }
+  { # Amalies phone
+    publicKey = "Iqoq00e5rUNygmjOKmSPzvDTzvUdpxkpwVrD6UJXG2w=";
+    allowedIPs = [
+      "10.100.0.9/32"
+    ];
+  }
+]

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "extra-config": {
       "locked": {
-        "lastModified": 1720193877,
-        "narHash": "sha256-f+ZtFQTbbmieTYLANn0AOz439/sIH+HumOAhItdYYig=",
+        "lastModified": 1745649002,
+        "narHash": "sha256-XNBExt3+U3o4lip+yj6oorCEPZ9Qe8PzBSFM5ZzVtSA=",
         "ref": "refs/heads/main",
-        "rev": "f9817deef3d4e56a31a89ee93419a9acd278e922",
-        "revCount": 9,
+        "rev": "50c9c15db2b309d299b1c19089c962979e01f45b",
+        "revCount": 13,
         "type": "git",
         "url": "file:///home/felixalb/nix-extra-config"
       },
@@ -18,11 +18,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -36,11 +36,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1681202837,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -56,35 +56,36 @@
         ]
       },
       "locked": {
-        "lastModified": 1720042825,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
+        "lastModified": 1764776959,
+        "narHash": "sha256-d+5CGloq7Lo1u2SkzhF8oiOdUc6Z5emh22nTXUB9CFA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
+        "rev": "e1680d594a9281651cbf7d126941a8c8e2396183",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "release-25.11",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "matrix-synapse-next": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1717234745,
-        "narHash": "sha256-MFyKRdw4WQD6V3vRGbP6MYbtJhZp712zwzjW6YiOBYM=",
+        "lastModified": 1765214213,
+        "narHash": "sha256-WSk8CTdIDFFP5VMJj9beve19nPMMdTsWnkCHVXqO/3E=",
         "owner": "dali99",
         "repo": "nixos-matrix-modules",
-        "rev": "d7dc42c9bbb155c5e4aa2f0985d0df75ce978456",
+        "rev": "82959f612ffd523a49c92f84358a9980a851747b",
         "type": "github"
       },
       "original": {
         "owner": "dali99",
-        "ref": "v0.6.0",
         "repo": "nixos-matrix-modules",
         "type": "github"
       }
@@ -92,20 +93,20 @@
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
-          "nixpkgs"
+          "nixpkgs-darwin"
         ]
       },
       "locked": {
-        "lastModified": 1722082646,
-        "narHash": "sha256-od8dBWVP/ngg0cuoyEl/w9D+TCNDj6Kh4tr151Aax7w=",
-        "owner": "lnl7",
+        "lastModified": 1764161084,
+        "narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
+        "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "0413754b3cdb879ba14f6e96915e5fdf06c6aab6",
+        "rev": "e95de00a471d07435e0527ff4db092c84998698e",
         "type": "github"
       },
       "original": {
-        "owner": "lnl7",
-        "ref": "master",
+        "owner": "nix-darwin",
+        "ref": "nix-darwin-25.11",
         "repo": "nix-darwin",
         "type": "github"
       }
@@ -114,14 +115,16 @@
       "inputs": {
         "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1710638386,
-        "narHash": "sha256-8etSpxJaCYBWTViHqQRR6o76WfDX2CuD1o2UQXQrwao=",
+        "lastModified": 1764813963,
+        "narHash": "sha256-Vs7Mamto+T8r1evk9myHepgHGNJkS2Kr0BF64NIei94=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "8f292bc64336ac9559d33c9a074a214d783a4c8e",
+        "rev": "491200d6848402bbab1421cccbc15a46f08c7f78",
         "type": "github"
       },
       "original": {
@@ -132,67 +135,63 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1706098335,
-        "narHash": "sha256-r3dWjT8P9/Ah5m5ul4WqIWD8muj5F+/gbCdjiNVBKmU=",
+        "lastModified": 1764677808,
+        "narHash": "sha256-H3lC7knbXOBrHI9hITQ7modLuX20mYJVhZORL5ioms0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a77ab169a83a4175169d78684ddd2e54486ac651",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-23.11",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1710628718,
-        "narHash": "sha256-y+l3eH53UlENaYa1lmnCBHusZb1kxBEFd2/c7lDsGpw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "6dc11d9859d6a18ab0c5e5829a5b8e4810658de3",
+        "rev": "1aab89277eb2d87823d5b69bae631a2496cff57a",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixpkgs-2211": {
       "locked": {
-        "lastModified": 1698318101,
-        "narHash": "sha256-gUihHt3yPD7bVqg+k/UVHgngyaJ3DMEBchbymBMvK1E=",
-        "owner": "nixos",
+        "narHash": "sha256-yqLXI+viN5+Vx5YpG9gNapKL3/+P6Pkprc36xNdyqSU=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/34bfa9403e42eece93d1a3740e9d8a02fceafbca.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/34bfa9403e42eece93d1a3740e9d8a02fceafbca.tar.gz"
+      }
+    },
+    "nixpkgs-darwin": {
+      "locked": {
+        "lastModified": 1764806471,
+        "narHash": "sha256-NsPsz003eWD8wp8vj5BnQzPoDyeQKRUfS2dvan2Y30M=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "63678e9f3d3afecfeafa0acead6239cdb447574c",
+        "rev": "6707b1809330d0f912f5813963bb29f6f194ee81",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
+        "ref": "nixpkgs-25.11-darwin",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1764667669,
+        "narHash": "sha256-7WUCZfmqLAssbDqwg9cUDAXrSoXN79eEEq17qhTNM/Y=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "418468ac9527e799809c900eda37cbff999199b6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1723688146,
-        "narHash": "sha256-sqLwJcHYeWLOeP/XoLwAtYjr01TISlkOfz+NG82pbdg=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c3d4ac725177c030b1e289015989da2ad9d56af0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "extra-config": "extra-config",
@@ -200,24 +199,25 @@
         "matrix-synapse-next": "matrix-synapse-next",
         "nix-darwin": "nix-darwin",
         "nix-minecraft": "nix-minecraft",
-        "nixpkgs": "nixpkgs_3",
-        "sops-nix": "sops-nix",
-        "unstable": "unstable"
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-2211": "nixpkgs-2211",
+        "nixpkgs-darwin": "nixpkgs-darwin",
+        "nixpkgs-unstable": "nixpkgs-unstable",
+        "sops-nix": "sops-nix"
       }
     },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable"
+        ]
       },
       "locked": {
-        "lastModified": 1710644594,
-        "narHash": "sha256-RquCuzxfy4Nr8DPbdp3D/AsbYep21JgQzG8aMH9jJ4A=",
+        "lastModified": 1764483358,
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "83b68a0e8c94b72cdd0a6e547a14ca7eb1c03616",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
         "type": "github"
       },
       "original": {
@@ -240,22 +240,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "unstable": {
-      "locked": {
-        "lastModified": 1723637854,
-        "narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -2,17 +2,22 @@
   description = "Felixalb System flake";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
-    unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11"; # Remember to update ./common/auto-upgrade.nix
+    nixpkgs-darwin.url = "github:NixOS/nixpkgs/nixpkgs-25.11-darwin";
+    nixpkgs-2211.url = "https://github.com/NixOS/nixpkgs/archive/34bfa9403e42eece93d1a3740e9d8a02fceafbca.tar.gz"; # old nixpgks for e.g. remmina
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
 
-    nix-darwin.url = "github:lnl7/nix-darwin/master";
-    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
+    nix-darwin.url = "github:nix-darwin/nix-darwin/nix-darwin-25.11";
+    nix-darwin.inputs.nixpkgs.follows = "nixpkgs-darwin";
 
-    home-manager.url = "github:nix-community/home-manager/release-24.05";
+    home-manager.url = "github:nix-community/home-manager/release-25.11";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    matrix-synapse-next.url = "github:dali99/nixos-matrix-modules/v0.6.0";
+    matrix-synapse-next.url = "github:dali99/nixos-matrix-modules"; # TODO: Lock to release
+    matrix-synapse-next.inputs.nixpkgs.follows = "nixpkgs";
+
     nix-minecraft.url = "github:Infinidoge/nix-minecraft";
+    nix-minecraft.inputs.nixpkgs.follows = "nixpkgs";
 
     extra-config.url = "git+file:///home/felixalb/nix-extra-config";
 
@@ -27,126 +32,82 @@
     , nix-minecraft
     , nix-darwin
     , nixpkgs
+    , nixpkgs-2211
+    , nixpkgs-darwin
+    , nixpkgs-unstable
     , sops-nix
-    , unstable
     , extra-config
   , ... }@inputs:
     let
       pkgs-overlay = final: prev: {
-        unstable = unstable.legacyPackages.${prev.system};
-
-        python311 = prev.python311.override {
-          packageOverrides = self: super: {
-            # k5test is broken on darwin, as of 24.05
-            gssapi = super.gssapi.overrideAttrs (old: {
-              doInstallCheck = false;
-            });
-          };
+        unstable = import nixpkgs-unstable {
+          system = prev.system;
+          config.allowUnfree = true;
         };
+
+        nixpkgs-2211 = import nixpkgs-2211 {
+          system = prev.system;
+          config.allowUnfree = true;
+        };
+
+        pwndbg-gdb-alias = prev.callPackage ./common/pwndbg-gdb-alias.nix { };
+        securecrt = prev.callPackage ./common/securecrt.nix { };
       };
     in
     {
-      nixosConfigurations = {
-        # Networking / VPN Gateway
-        burnham = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
+      nixosConfigurations = let
+        normalSys = name: hostConfig: nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux"; # TODO - Handle
           specialArgs = {
             inherit inputs;
           };
           modules = [
-            # Overlays-module makes "pkgs.unstable" available in configuration.nix
-            ({ config, pkgs, ... }: { nixpkgs.overlays = [ pkgs-overlay ]; })
+            ({ config, pkgs, ... }: {
+              # Make "pkgs.unstable" etc. available
+              nixpkgs.overlays = [ pkgs-overlay ] ++ hostConfig.overlays or [ ];
+            })
 
-            ./hosts/burnham/configuration.nix
-            ./common/domeneshop-dyndns.nix
+            ./hosts/${name}/configuration.nix
             sops-nix.nixosModules.sops
             home-manager.nixosModules.home-manager {
               home-manager.useGlobalPkgs = true;
               home-manager.useUserPackages = true;
-              home-manager.users."felixalb" = import ./hosts/burnham/home.nix;
+              home-manager.users = {
+                "felixalb" = import ./hosts/${name}/home.nix;
+              } // hostConfig.home-manager-users or { };
             }
-          ];
+          ] ++ hostConfig.modules or [ ];
         };
+      in {
+
         # Media / storage server
-        challenger = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = {
-            inherit inputs;
-          };
+        challenger = normalSys "challenger" {
           modules = [
-            # Overlays-module makes "pkgs.unstable" available in configuration.nix
-            ({ config, pkgs, ... }: { nixpkgs.overlays = [ pkgs-overlay ]; })
-
-            ./hosts/challenger/configuration.nix
             extra-config.nixosModules.default
-            sops-nix.nixosModules.sops
-            home-manager.nixosModules.home-manager {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users."felixalb" = import ./hosts/challenger/home.nix;
-            }
           ];
         };
+
         # General application server
-        defiant = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = {
-            inherit inputs;
-          };
+        defiant = normalSys "defiant" {
           modules = [
-            # Overlays-module makes "pkgs.unstable" available in configuration.nix
-            ({ config, pkgs, ... }: { nixpkgs.overlays = [ pkgs-overlay ]; })
-
-            ./hosts/defiant/configuration.nix
             ./common/domeneshop-dyndns.nix
-            sops-nix.nixosModules.sops
             matrix-synapse-next.nixosModules.default
-            home-manager.nixosModules.home-manager {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users."felixalb" = import ./hosts/defiant/home.nix;
-            }
           ];
         };
-        # Work desktop
-        felixalbpc = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = {
-            inherit inputs;
-          };
-          modules = [
-            # Overlays-module makes "pkgs.unstable" available in configuration.nix
-            ({ config, pkgs, ... }: { nixpkgs.overlays = [ pkgs-overlay ]; })
 
-            ./hosts/felixalbpc/configuration.nix
-            sops-nix.nixosModules.sops
-            home-manager.nixosModules.home-manager {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users."felixalb" = import ./hosts/felixalbpc/home.nix;
-            }
-          ];
-        };
+        # Work laptop
+        fa-t14-2025 = normalSys "fa-t14-2025" { };
+
         # Web host
-        malcolm = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          specialArgs = {
-            inherit inputs;
-          };
-          modules = [
-            # Overlays-module makes "pkgs.unstable" available in configuration.nix
-            ({ config, pkgs, ... }: { nixpkgs.overlays = [ pkgs-overlay ]; })
+        leonard = normalSys "leonard" { };
 
-            ./hosts/malcolm/configuration.nix
-            sops-nix.nixosModules.sops
-            home-manager.nixosModules.home-manager {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users."felixalb" = import ./hosts/malcolm/home.nix;
-            }
-          ];
-        };
+        # General application server
+        morn = normalSys "morn" { };
+
+        # Home desktop
+        sisko = normalSys "sisko" { };
       };
+
       # Daily driver macbook
       darwinConfigurations.worf = nix-darwin.lib.darwinSystem {
         system = "aarch64-darwin";
@@ -154,14 +115,14 @@
           inherit inputs;
         };
         modules = [
-          ./hosts/worf/configuration.nix
           ({ config, pkgs, ... }: { nixpkgs.overlays = [ pkgs-overlay ]; })
+
+          ./hosts/worf/configuration.nix
           home-manager.darwinModules.home-manager {
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
             home-manager.users."felixalb" = import ./hosts/worf/home.nix;
           }
-          # sops-nix.nixosModules.sops
         ];
       };
 

home/alacritty.nix

@@ -19,7 +19,7 @@
         decorations = "none"; # full/none/transparent/buttonless
 
         # Transparency:
-        # opacity = 0.95;
+        opacity = lib.mkDefault 0.95;
       };
 
       scrolling = {
@@ -50,7 +50,34 @@
 
       colors = {
         draw_bold_text_with_bright_colors = true;
-        # # Tomorrow Night Bright
+
+        # # gruvbox_material_medium_dark
+        #  primary = {
+        #     background = "0x282828";
+        #     foreground = "0xd4be98";
+        #   };
+        #   normal = {
+        #     black =  "0x3c3836";
+        #     red =     "0xea6962";
+        #     green =   "0xa9b665";
+        #     yellow =  "0xd8a657";
+        #     blue =    "0x7daea3";
+        #     magenta = "0xd3869b";
+        #     cyan =    "0x89b482";
+        #     white =   "0xd4be98";
+        #   };
+        #   bright = {
+        #     black =   "0x3c3836";
+        #     red =     "0xea6962";
+        #     green =   "0xa9b665";
+        #     yellow =  "0xd8a657";
+        #     blue =    "0x7daea3";
+        #     magenta = "0xd3869b";
+        #     cyan =    "0x89b482";
+        #     white =   "0xd4be98";
+        #   };
+
+        # # # Tomorrow Night Bright
         # primary = {
         #   background = "0x141414";
         #   foreground = "0xeaeaea";
@@ -83,6 +110,7 @@
         #   white   = "0xffffff";
         # };
 
+
         # Nord:
         primary = {
           background = "0x2e3440";

home/amalieem/default.nix

@@ -0,0 +1,43 @@
+{ pkgs, lib, ... }:
+{
+  imports = [
+    ./../alacritty.nix
+  ];
+
+  home = {
+    packages = with pkgs; [
+      papers
+      kitty
+      pavucontrol
+
+      # Window Manager Extras
+      bibata-cursors
+      hyprcursor
+      hypridle
+      hyprlock
+      hyprpaper
+      hyprshot
+      nautilus
+      networkmanager
+      swaynotificationcenter
+      waybar
+      wl-clipboard
+    ];
+
+    sessionVariables = {
+      EDITOR = "nvim";
+      VISUAL = "nvim";
+    };
+  };
+
+  programs = {
+    alacritty = {
+      enable = true;
+      settings.window.opacity = 0.92;
+    };
+    firefox.enable = true;
+    wofi.enable = true;
+  };
+
+  home.stateVersion = "24.11";
+}

home/base.nix

@@ -9,8 +9,9 @@
     packages = with pkgs; [
       bat
       bottom
-      ncdu
+      # ncdu
       neofetch
+      pwgen
       sshfs
       sshuttle
     ];
@@ -26,10 +27,12 @@
     enableZshIntegration = true;
   };
 
+  programs.fzf.enable = true;
+
   programs.git = {
     enable = true;
 
-    extraConfig = {
+    settings = {
       pull.rebase = true;
       push.autoSetupRemote = true;
       color.ui = "auto";
@@ -40,6 +43,9 @@
         name = "Felix Albrigtsen";
         email = lib.mkDefault "felix@albrigtsen.it";
       };
+      safe = {
+        directory = "/config";
+      };
     };
     ignores = [
       "*~"
@@ -49,4 +55,15 @@
     ];
   };
 
+  programs.tmux = {
+    enable = true;
+    sensibleOnTop = true;
+
+    baseIndex = 1;
+    clock24 = true;
+    keyMode = "vi";
+    mouse = true;
+    terminal = "screen-256color";
+  };
+
 }

home/neovim.nix

@@ -28,7 +28,6 @@ in {
       coc-html
       coc-json
       coc-nvim
-      coc-pyright
 
       vim-nix
       vim-puppet
@@ -51,7 +50,7 @@ in {
       " Integrate status with lightline
       let g:lightline = {
         \   'active': {
-        \     'left': [[  'coc_info', 'coc_hints', 'coc_errors', 'coc_warnings', 'coc_ok' ], [ 'coc_status'  ]]
+        \     'left': [[ 'mode', 'paste', 'filename', 'readonly', 'coc_info', 'coc_hints', 'coc_errors', 'coc_warnings', 'coc_ok' ], [ 'coc_status'  ]]
         \   }
         \ }
 
@@ -98,11 +97,16 @@ in {
       " Nerdtree-settings
       " Toggle nerdtree on Ctrl+t
       nmap <silent> <C-t> :NERDTreeToggle<CR>
-      autocmd VimEnter * NERDTree " Autostart nerdtree on vim startup
-      autocmd VimEnter * wincmd p " Unselect nerdtree window
       " Close vim is Nerdtree is the only buffer left
       autocmd bufenter * if (winnr("$") == 1 && exists("b:NERDTree") && b:NERDTree.isTabTree()) | q | endif
 
+      if empty($AERC_ACCOUNT) && empty($MOZ_APP_LAUNCHER)
+        autocmd VimEnter * NERDTree " Autostart nerdtree on vim startup
+        autocmd VimEnter * wincmd p " Unselect nerdtree window
+      endif
+
+      autocmd Filetype go setlocal expandtab tabstop=4 shiftwidth=4 softtabstop=4
+
       " List and switch buffers on Ctrl+k
       " nnoremap <C-k> :set nomore <Bar> :ls <Bar> :set more <CR>:b<Space>
       nnoremap <silent> <C-k> !echo "Did you mean C-a?"<CR>
@@ -116,6 +120,9 @@ in {
       nnoremap <C-s> <cmd>Telescope find_files<cr>
       nnoremap <C-g> <cmd>Telescope live_grep<cr>
 
+      " Don't darken the background
+      autocmd VimEnter * highlight normal ctermbg=NONE guibg=NONE
+
       " Show trailing whitespace
       highlight ExtraWhitespace ctermbg=red guibg=red
       match ExtraWhitespace /\s\+$/
@@ -123,10 +130,8 @@ in {
       " Disable search highlights
       map <Leader><Space> :noh<CR>
 
-      " Start with copilot disabled
-      if exists("*Copilot")
-        autocmd VimEnter *  Copilot disable
-      endif
+      " Start with Coc disabled
+      " autocmd VimEnter * CocDisable
     '';
   };
 

home/zsh.nix

@@ -34,28 +34,35 @@
         ];
       };
 
-      initExtra = ''
+      initContent = ''
         # Autocomplete ../
         zstyle ':completion:*' special-dirs true
-        export PATH="$HOME/.config/emacs/bin:$PATH"
+        export PATH="$HOME/.config/emacs/bin:$HOME/.cargo/bin:$PATH"
         unalias "gs"
+
+        if [ -f ~/.config/zsh-extras ]; then
+          source ~/.config/zsh-extras
+        fi
       '';
 
       shellAliases = {
-        l = "exa -l";
         c = "z";
-        tree = "exa --tree --icons";
+        em = "emacsclient -c";
+        emnw = "emacsclient -nw";
+        grep = "grep --color=auto";
+        l = "exa -l";
+        ls = "ls --color=auto";
+        nd = "nix develop --command zsh";
         s = "nix-shell --run zsh";
         sp = "nix-shell --run zsh -p";
         spu = "nix-shell -I nixpkgs=channel:nixos-unstable --run zsh -p";
-        nd = "nix develop --command zsh";
-        em = "emacsclient -c";
-        emnw = "emacsclient -nw";
-        gst = "git status -sb";
-        gcm = "git commit -m";
-        gps = "git push";
-        gpl = "git pull";
+        tree = "exa --tree --icons";
+
         "git clone git clone" = "git clone";
+        gcm = "git commit -m";
+        gpl = "git pull";
+        gps = "git push";
+        gst = "git status -sb";
       };
     };
 

hosts/burnham/configuration.nix

@@ -1,40 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports =
-    [
-      ../../base.nix
-      ../../common/metrics-exporters.nix
-      ./hardware-configuration.nix
-
-      # Infrastructure
-      ./services/wireguard.nix
-
-      # Other
-      ./services/dyndns.nix
-      ./services/nginx.nix
-      ./services/thelounge.nix
-  ];
-
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/sda";
-
-  networking = {
-    hostName = "burnham";
-    defaultGateway = "192.168.11.1";
-    interfaces.ens18.ipv4 = {
-      addresses = [
-        { address = "192.168.11.109"; prefixLength = 24; }
-      ];
-    };
-    hostId = "8e24f235";
-  };
-
-  sops.defaultSopsFile = ../../secrets/burnham/burnham.yaml;
-
-  environment.variables = { EDITOR = "vim"; };
-
-  system.stateVersion = "23.11";
-}
-

hosts/burnham/home.nix

@@ -1,12 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  imports = [
-    ./../../home/base.nix
-  ];
-
-  programs = {
-    zsh.shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
-  };
-
-  home.stateVersion = "23.05";
-}

hosts/burnham/services/dyndns.nix

@@ -1,11 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  sops.secrets."domeneshop/netrc" = { };
-
-  services.domeneshop-dyndns = {
-    enable = true;
-    domain = "site2.feal.no";
-    netrcFile = config.sops.secrets."domeneshop/netrc".path;
-  };
-}

hosts/burnham/services/wireguard.nix

@@ -1,62 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.networking.wireguard.interfaces."wg0";
-in {
-  networking = {
-    nat = {
-      enable = true;
-      externalInterface = "ens18";
-      internalInterfaces = [ "wg0" ];
-    };
-    firewall.allowedUDPPorts = [ cfg.listenPort ];
-
-    wireguard.interfaces."wg0" = {
-      ips = [ "10.100.0.2/24" ];
-      listenPort = 51820;
-      privateKeyFile = "/etc/wireguard/burnham.private";
-
-      postSetup = ''
-        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -d 192.168.11.0/24 -o eth0 -j MASQUERADE
-      '';
-      postShutdown = ''
-        ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -d 192.168.11.0/24 -o eth0 -j MASQUERADE
-      '';
-
-      peers = [
-        { # Defiant
-          publicKey = "8/711GhmN9+NcduHF4JPkfoZPE0qsDLuwhABcPyjNxI=";
-          persistentKeepalive = 120;
-          allowedIPs = [
-            "10.100.0.1/32"
-            "192.168.10.0/24"
-          ];
-          endpoint = "site3.feal.no:51902";
-        }
-        { # Worf
-          publicKey = "kW8SyzCh2tw8GzZV6bPn+IQVNUoUhseNfEm3rHnR1So=";
-          allowedIPs = [
-            "10.100.0.4/32"
-          ];
-        }
-        { # Phone
-          publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk=";
-          allowedIPs = [
-            "10.100.0.5/32"
-          ];
-        }
-        { # Riker
-          publicKey = "r715vpgH1H0zvN+Z5wcNKcOo5e6UM3fBfh9BZwTBjmA=";
-          allowedIPs = [
-            "10.100.0.6/32"
-          ];
-        }
-        { # Work-laptop
-          publicKey = "px4YstB16lFjgdLQkH55wz8gQRupX/LTxg8dNFijDTA=";
-          allowedIPs = [
-            "10.100.0.7/32"
-          ];
-        }
-      ];
-    };
-  };
-}

hosts/challenger/amalieem.nix

@@ -0,0 +1,37 @@
+{ config, pkgs, lib, ... }:
+let
+  cmdChownManga = pkgs.writeScriptBin "chownManga" ''
+    #!${pkgs.stdenv.shell}
+
+    chown -R amalieem:komga /tank/media/komga/Amalie
+    chmod -R 750 /tank/media/komga/Amalie
+  '';
+in {
+  users.users."amalieem" = {
+    isNormalUser = true;
+    home = "/home/amalieem";
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7e+BAoXIFmTeeBYAVImQAcyx6SCoYCErA7h16OGL70 amalieem@wentworth"
+    ];
+    packages = with pkgs; [
+      cmdChownManga
+
+      mangal
+      rsync
+    ];
+  };
+
+  security.sudo = {
+    enable = true;
+    extraRules = [{
+      commands = [
+        {
+          command = "${lib.getExe cmdChownManga}";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+      users = [ "amalieem" ];
+    }];
+  };
+}
+

hosts/challenger/backup.nix

@@ -1,38 +1,84 @@
 { config, pkgs, lib, ... }:
 {
-  services.borgbackup.jobs =
-    let
-      borgJob = name: {
-        environment.BORG_RSH = "ssh -i /root/.ssh/fealsyn1";
-        environment.BORG_REMOTE_PATH = "/usr/local/bin/borg";
-        repo = "ssh://backup@feal-syn1.home.feal.no/volume2/backup/borg/voyager/${name}";
-        compression = "auto,zstd";
-      };
-    in {
-      postgresDaily = borgJob "postgres::daily" // {
-        paths = "/var/backup/postgres";
-        startAt = "*-*-* 05:15:00"; # 2 hours after postgresqlBackup
-        extraInitArgs = "--storage-quota 10G";
-        encryption = {
-          mode = "repokey-blake2";
-          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
-        };
-      };
+  services.restic.backups = let
+    localJob = name: paths: {
+      inherit paths;
+      repository = "/mnt/feal-syn1/backup/challenger/${name}";
+      passwordFile = config.sops.secrets."restic/${name}".path;
+      initialize = true;
+      pruneOpts = [
+        "--keep-daily 7"
+        "--keep-weekly 4"
+        "--keep-monthly 3"
+        "--keep-yearly 10"
+      ];
+    };
+    cloudJob = name: paths: {
+      inherit paths;
+      # "rsyncnet" connection details specified in /root/.ssh/config
+      repository = "sftp://rsyncnet/restic/challenger/${name}";
+      passwordFile = config.sops.secrets."restic/${name}".path;
+      initialize = true;
+      pruneOpts = [
+        # rsync.net keeps daily snapshots
+        "--keep-weekly 4"
+        "--keep-monthly 36"
+      ];
+    };
+  in {
 
-      postgresWeekly = borgJob "postgres::weekly" // {
-        paths = "/var/backup/postgres";
-        startAt = "Mon *-*-* 05:15:00"; # 2 hours after postgresqlBackup
-        extraInitArgs = "--storage-quota 10G";
-        encryption = {
-          mode = "repokey-blake2";
-          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
-        };
-      };
-
-      # TODO: timemachine, nextcloud, komga, calibre
+    # Calibre metadata and config
+    calibre = localJob "calibre" [
+      "/var/lib/calibre-web"
+      "/var/lib/calibre-server"
+    ];
 
+    # Other system backups (NB: Large!)
+    hostBackups = localJob "hostBackups" [
+      "/tank/backup"
+    ] // {
+      pruneOpts = [ "--keep-monthly 12" ];
     };
 
-  sops.secrets."borg/postgres" = { };
-  sops.secrets."borg/transmission" = { };
+    media = localJob "media" [
+      "/tank/media/books"
+      "/tank/media/komga"
+      "/tank/media/music"
+    ];
+    media-remote = cloudJob "media" [
+      "/tank/media/books"
+      "/tank/media/komga"
+      "/tank/media/music"
+    ] // {
+      pruneOpts = [ "--keep-monthly 12" ];
+    };
+
+    # Nextcloud config and data
+    nextcloud = localJob "nextcloud" [ "/tank/nextcloud" ];
+    nextcloud-remote = cloudJob "nextcloud" [ "/tank/nextcloud" ];
+
+    # Postgresql databases
+    postgres = (localJob "postgres" [ "/var/backup/postgres" ]) // {
+      timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
+    };
+    postgres-remote = (cloudJob "postgres" [ "/var/backup/postgres" ]) // {
+      timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
+    };
+
+    # Transmission metadata/config
+    transmission = localJob "transmission" [ "/var/lib/transmission" ];
+
+    # TODO: timemachine
+  };
+
+  sops.secrets."restic/calibre" = { };
+  sops.secrets."restic/hostBackups" = { };
+  sops.secrets."restic/media" = { };
+  sops.secrets."restic/nextcloud" = { };
+  sops.secrets."restic/postgres" = { };
+  sops.secrets."restic/transmission" = { };
+
+  environment.systemPackages = with pkgs; [
+    restic
+  ];
 }

hosts/challenger/configuration.nix

@@ -7,14 +7,16 @@
 
       ../../base.nix
       ../../common/metrics-exporters.nix
+      ./amalieem.nix
       ./backup.nix
-      ./exports.nix
+      # ./exports.nix
       ./filesystems.nix
 
+      # ./services/archivebox.nix
+      ./services/audiobookshelf.nix
       ./services/calibre.nix
       ./services/jellyfin.nix
       ./services/komga.nix
-      ./services/navidrome.nix
       ./services/nextcloud.nix
       ./services/nginx.nix
       ./services/postgres.nix
@@ -23,7 +25,7 @@
 
   networking = {
     hostName = "challenger";
-    bridges.br0.interfaces = [ "enp5s0" ];
+    bridges.br0.interfaces = [ "ens18" ];
     interfaces.br0.useDHCP = false;
     interfaces.br0.ipv4.addresses = [
       { address = "192.168.10.161"; prefixLength = 24; }
@@ -43,6 +45,8 @@
   virtualisation.docker.enable = true;
   virtualisation.oci-containers.backend = "docker";
 
+  security.polkit.enable = true; # Required for nextcloud
+
   nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
        "nvidia-x11"
        "nvidia-settings"
@@ -50,9 +54,10 @@
 
   hardware.nvidia = {
     modesetting.enable = true;
+    open = false;
   };
 
-  hardware.opengl.enable = true;
+  hardware.graphics.enable = true;
   services.xserver.videoDrivers = ["nvidia"];
 
   system.stateVersion = "24.05";

hosts/challenger/exports.nix

@@ -1,12 +1,21 @@
 { config, pkgs, lib, ... }:
 {
-  # Enable nfs4 only
-  services.nfs.server = {
-    enable = true;
-    exports = ''
-    ''; # TODO
+  fileSystems = {
+    "/export/riker-backup" = {
+      device = "/tank/backup/riker";
+      options = [ "bind" ];
+    };
   };
 
-  networking.firewall.allowedTCPPorts = [ 111 2049 20048 ];
-  networking.firewall.allowedUDPPorts = [ 111 20048];
+  # Enable nfs4 only
+  # services.nfs.server = {
+  #   enable = true;
+  #   exports = ''
+  #     /export                   192.168.10.67(rw,fsid=0,no_subtree_check)
+  #     /export/riker-backup      192.168.10.67(rw,nohide,no_subtree_check,no_root_squash)
+  #   '';
+  # };
+
+  # networking.firewall.allowedTCPPorts = [ 111 2049 20048 ];
+  # networking.firewall.allowedUDPPorts = [ 111 20048];
 }

hosts/challenger/filesystems.nix

@@ -11,7 +11,6 @@
       requestEncryptionCredentials = false;
     };
     supportedFilesystems = [ "zfs" ];
-    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
   };
   services.zfs.autoScrub = {
     enable = true;
@@ -20,8 +19,30 @@
 
   fileSystems = {
     "/mnt/feal-syn1/backup" = {
-      device = "feal-syn1.home.feal.no:/volume2/backup";
+      # device = "feal-syn1.home.feal.no:/volume2/backup";
+      device = "192.168.10.162:/volume2/backup";
       fsType = "nfs";
+      options = [
+        "defaults"
+        "noatime"
+        "rw"
+        "nfsvers=3"
+        "x-systemd.automount"
+        "noauto"
+      ];
+    };
+    "/mnt/feal-syn2/backup" = {
+      # device = "feal-syn1.home.feal.no:/volume2/backup";
+      device = "192.168.11.163:/volume1/challenger";
+      fsType = "nfs";
+      options = [
+        "defaults"
+        "noatime"
+        "rw"
+        "nfsvers=3"
+        "x-systemd.automount"
+        "noauto"
+      ];
     };
   };
 }

hosts/challenger/hardware-configuration.nix

@@ -1,25 +1,22 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/ea31d0ea-2949-420a-99ea-7f77c4b7091e";
+    { device = "/dev/disk/by-uuid/7101364b-9056-4309-afeb-3c17b220684f";
       fsType = "ext4";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/169B-94E2";
+    { device = "/dev/disk/by-uuid/FDCE-A287";
       fsType = "vfat";
       options = [ "fmask=0077" "dmask=0077" ];
     };

hosts/challenger/services/archivebox.nix

@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+  host = "127.0.1.2";
+  port = "5009";
+  uid = 911;
+  gid = 911;
+in {
+  users.users.archivebox = {
+    inherit uid;
+    group = "archivebox";
+    isSystemUser = true;
+    useDefaultShell = true;
+    description = "ArchiveBox web archiving tool";
+  };
+
+  users.groups.archivebox = {
+    inherit gid;
+  };
+
+  # ArchiveBox - Open source self-hosted web archiving.
+  virtualisation.oci-containers.containers.archivebox = {
+    image = "archivebox/archivebox:0.8.5rc50";
+    ports = [ "${host}:${port}:8000" ];
+    volumes = [
+      "/tank/archivebox:/data"
+    ];
+  };
+
+  services.nginx.virtualHosts."archivebox.home.feal.no" = {
+    locations."/" = {
+      proxyPass = "http://${host}:${port}";
+    };
+  };
+
+}

hosts/challenger/services/audiobookshelf.nix

@@ -0,0 +1,57 @@
+{ config, lib, pkgs, ... }:
+let
+  domain = "audiobooks.home.feal.no";
+  host = "127.0.1.2";
+  port = 5016;
+in {
+  fileSystems = {
+    "/var/lib/audiobookshelf" = {
+      device = "/tank/media/audiobookshelf/config";
+      options = [ "bind" ];
+    };
+  };
+
+  services.audiobookshelf = {
+    enable = true;
+    dataDir = "audiobookshelf";
+    inherit host port;
+  };
+
+  systemd.services.audiobookshelf = {
+    requires = [ "var-lib-audiobookshelf.mount" ];
+    serviceConfig = {
+      # Better safe than sorry :)
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProtectClock = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      ReadWritePaths = [
+        "/var/lib/audiobookshelf"
+        "/tank/media/audiobookshelf"
+      ];
+      RemoveIPC = true;
+      RestrictSUIDSGID = true;
+      UMask = "0007";
+      RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
+      SystemCallArchitectures = "native";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    locations."/" = {
+      proxyPass = "http://${host}:${toString port}";
+      proxyWebsockets = true;
+    };
+  };
+}

hosts/challenger/services/jellyfin.nix

@@ -6,10 +6,6 @@
 
   users.users.${config.services.jellyfin.user}.extraGroups = [ "video" "render" ];
 
-  systemd.services.jellyfin.serviceConfig = {
-    DeviceAllow = lib.mkForce [ "/dev/dri/card0" ];
-  };
-
   services.nginx.virtualHosts."jellyfin.home.feal.no" = {
     serverAliases = [ "jf.feal.no" ];
     locations = {

hosts/challenger/services/komga.nix

@@ -1,16 +1,18 @@
 { config, lib, pkgs, ... }:
 let
   domain = "komga.home.feal.no";
-  cfg = config.services.komga;
+  port = 5001;
 in {
   services.komga = {
     enable = true;
     stateDir = "/tank/media/komga";
-    port = 5001;
+    settings.server = {
+      inherit port;
+    };
   };
 
   services.nginx.virtualHosts.${domain} = {
-    locations."/".proxyPass = "http://127.0.0.1:${toString cfg.port}";
+    locations."/".proxyPass = "http://127.0.0.1:${toString port}";
 
     extraConfig = ''
       client_max_body_size 512M;

hosts/challenger/services/navidrome.nix

@@ -1,20 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  domain = "music.feal.no";
-  cfg = config.services.navidrome;
-in {
-  services.navidrome = {
-    enable = true;
-    settings = {
-      BaseUrl = "https://${domain}";
-      EnableSharing = true;
-      EnableTranscodingConfig = true;
-      MusicFolder = "/tank/media/music/";
-      SubsonicArtistParticipations = true;
-    };
-  };
-
-  services.nginx.virtualHosts."${domain}".locations."/" = {
-    proxyPass = "http://${cfg.settings.Address}:${toString cfg.settings.Port}";
-  };
-}

hosts/challenger/services/nextcloud.nix

@@ -5,7 +5,7 @@ let
 in {
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud29;
+    package = pkgs.nextcloud32;
     inherit hostName;
     home = "/tank/nextcloud";
     https = true;
@@ -46,7 +46,9 @@ in {
       oidc_login_filter_allowed_values = [ "nextcloud-user" ];
       oidc_login_disable_registration = false;
 
-      "memories.exiftool" = "${cfg.home}/store-apps/memories/bin-ext/exiftool-amd64-glibc";
+      "memories.exiftool" = pkgs.writeShellScript "exiftool-perl" ''
+        ${lib.getExe pkgs.perl} ${cfg.home}/store-apps/memories/bin-ext/exiftool/exiftool "$@"
+      '';
       "memories.exiftool_no_local" = false;
       "memories.vod.disable" = false;
       "memories.vod.ffmpeg" = "${lib.getExe pkgs.ffmpeg-headless}";
@@ -133,7 +135,7 @@ in {
       ProtectProc = "invisible";
       ReadWritePaths = [ "/tank/nextcloud" "/run/phpfpm" "/run/systemd" ];
       ReadOnlyPaths = [ "/run/secrets" "/nix/store" ];
-      InaccessbilePaths = [ "/tank/media" "/tank/backup" ];
+      InaccessiblePaths = [ "/tank/media" "/tank/backup" ];
       RemoveIPC = true;
       RestrictSUIDSGID = true;
       UMask = "0007";

hosts/challenger/services/nginx.nix

@@ -10,6 +10,8 @@
     recommendedTlsSettings = true;
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
+
+    virtualHosts."cloud.feal.no".default = true;
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];

hosts/challenger/services/timemachine.nix

@@ -1,9 +1,9 @@
 { config, pkgs, ... }:
   let
-    timeMachineDir = "/tank/backup/worf";
+    timeMachineDir = "/tank/backup/worf2";
     user = "worf-backup";
-    sizeLimit = "800000"; # MiB
-    allowedIPs = "192.168.10.2 192.168.10.5"; #TODO
+    sizeLimit = "1000000"; # MiB
+    allowedIPs = "192.168.10.2 192.168.10.34"; #TODO
   in {
   services.avahi = {
     enable = true;

hosts/defiant/backup.nix

@@ -1,62 +1,50 @@
 { config, pkgs, lib, ... }:
 {
-  services.borgbackup.jobs =
-    let
-      borgJob = name: {
-        environment.BORG_RSH = "ssh -i /root/.ssh/fealsyn1";
-        environment.BORG_REMOTE_PATH = "/usr/local/bin/borg";
-        repo = "ssh://backup@feal-syn1.home.feal.no/volume2/backup/borg/defiant/${name}";
-        compression = "auto,zstd";
-      };
-    in {
-      postgresDaily = borgJob "postgres::daily" // {
-        paths = "/data/backup/postgresql";
-        startAt = "*-*-* 05:15:00"; # 2 hours after postgresqlBackup
-        extraInitArgs = "--storage-quota 10G";
-        encryption = {
-          mode = "repokey-blake2";
-          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
-        };
-      };
-
-      postgresWeekly = borgJob "postgres::weekly" // {
-        paths = "/data/backup/postgresql";
-        startAt = "Mon *-*-* 05:15:00"; # 2 hours after postgresqlBackup
-        extraInitArgs = "--storage-quota 10G";
-        encryption = {
-          mode = "repokey-blake2";
-          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
-        };
-      };
-
-      gitea = borgJob "gitea::weekly" // {
-        paths = "/tank/services/gitea";
-        startAt = "Mon *-*-* 05:15:00";
-        extraInitArgs = "--storage-quota 20G";
-        encryption = {
-          mode = "repokey-blake2";
-          passCommand = "cat ${config.sops.secrets."borg/gitea".path}";
-        };
-      };
-
-      minecraft = borgJob "minecraft::weekly" // {
-        paths = "/var/lib/minecraft-wack";
-        startAt = "weekly";
-        extraInitArgs = "--storage-quota 20G";
-        encryption.mode = "none";
-
-        preHook = ''
-          ${pkgs.mcrcon}/bin/mcrcon -p wack "say Starting Backup" "save-off" "save-all"
-        '';
-
-        postHook = ''
-          ${pkgs.mcrcon}/bin/mcrcon -p wack "save-all" "say Completed Backup" "save-on" "save-all"
-        '';
-      };
-
+  services.restic.backups = let
+    localJob = name: paths: {
+      inherit paths;
+      repository = "/mnt/feal-syn1/backup/defiant/${name}";
+      passwordFile = config.sops.secrets."restic/${name}".path;
+      initialize = true;
+      pruneOpts = [
+        "--keep-daily 3"
+        "--keep-weekly 4"
+        "--keep-monthly 3"
+      ];
+    };
+    cloudJob = name: paths: {
+      inherit paths;
+      # "rsyncnet" connection details specified in /root/.ssh/config
+      repository = "sftp://rsyncnet/restic/defiant/${name}";
+      passwordFile = config.sops.secrets."restic/${name}".path;
+      initialize = true;
+      pruneOpts = [
+        # rsync.net keeps daily snapshots
+        "--keep-weekly 4"
+        "--keep-monthly 36"
+      ];
+    };
+  in {
+    postgres = (localJob "postgres" [ "/tank/backup/postgresql" ]) // {
+      timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
+    };
+    postgres-remote = (cloudJob "postgres" [ "/tank/backup/postgresql" ]) // {
+      timerConfig.OnCalendar = "05:15"; # 2h after postgresqlBackup
     };
 
-  # TODO: Matrix (keys,media,db), home-assistant, pihole, vaultwarden
-  sops.secrets."borg/postgres" = { };
-  sops.secrets."borg/gitea" = { };
+    gitea = (localJob "gitea" [ "/tank/services/gitea" ]);
+    gitea-remote = (cloudJob "gitea" [ "/tank/services/gitea" ]);
+
+    matrix-synapse = (localJob "matrix-synapse" [ "/var/lib/matrix-synapse" ]);
+    matrix-synapse-remote = (cloudJob "matrix-synapse" [ "/var/lib/matrix-synapse" ]);
+
+    vaultwarden = (localJob "vaultwarden" [ "/var/lib/bitwarden_rs" ]);
+    vaultwarden-remote = (cloudJob "vaultwarden" [ "/var/lib/bitwarden_rs" ]);
+  };
+
+  # TODO: home-assistant, pihole
+  sops.secrets."restic/postgres" = { };
+  sops.secrets."restic/gitea" = { };
+  sops.secrets."restic/matrix-synapse" = { };
+  sops.secrets."restic/vaultwarden" = { };
 }

hosts/defiant/configuration.nix

@@ -5,28 +5,29 @@
     [
       ../../base.nix
       ../../common/metrics-exporters.nix
+      ./filesystems.nix
       ./hardware-configuration.nix
 
       # Infrastructure
       ./backup.nix
       ./libvirt.nix
+      ./services/dyndns.nix
       ./services/nginx.nix
       ./services/pihole.nix
       ./services/postgresql.nix
       ./services/wireguard.nix
 
       # Services
-      ./services/dyndns.nix
-      ./services/flame.nix
       ./services/gitea.nix
       ./services/hedgedoc.nix
       ./services/home-assistant.nix
       ./services/keycloak.nix
       ./services/matrix
       ./services/microbin.nix
-      # ./services/minecraft.nix
+      # ./services/minecraft/home.nix
       ./services/monitoring
-      ./services/rtl-tcp.nix
+      # ./services/rtl-tcp.nix
+      # ./services/searx.nix
       ./services/vaultwarden.nix
   ];
 
@@ -44,16 +45,6 @@
   sops.defaultSopsFile = ../../secrets/defiant/defiant.yaml;
 
   environment.variables = { EDITOR = "vim"; };
-  environment.systemPackages = with pkgs; [
-    zfs
-  ];
-
-  boot = {
-    zfs.extraPools = [ "tank" ];
-    supportedFilesystems = [ "zfs" ];
-    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-  };
-  services.prometheus.exporters.zfs.enable = true;
 
   virtualisation.docker.enable = true;
   virtualisation.oci-containers.backend = "docker";

hosts/defiant/filesystems.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, lib, ... }:
+{
+  # Boot drives are defined in ./hardware-configuration.nix
+
+  boot = {
+    zfs.extraPools = [ "tank" ];
+    supportedFilesystems = [ "zfs" ];
+  };
+  services.prometheus.exporters.zfs.enable = true;
+
+  environment.systemPackages = with pkgs; [
+    cifs-utils
+    zfs
+  ];
+
+  fileSystems = {
+    "/mnt/feal-syn1/backup" = {
+      device = "192.168.10.162:/volume2/backup";
+      fsType = "nfs";
+      options = [
+        "defaults"
+        "noatime"
+        "rw"
+        "nfsvers=3"
+        "x-systemd.automount"
+        "noauto"
+      ];
+    };
+  };
+}

hosts/defiant/services/flame.nix

@@ -1,22 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  domain = "flame.home.feal.no";
-  host = "127.0.1.2";
-  port = "5005";
-in {
-  # Flame - Homelab dashboard/linktree
-  virtualisation.oci-containers.containers = {
-    flame = {
-      image = "pawelmalak/flame";
-      ports = [ "${host}:${port}:5005" ];
-      volumes = [
-        "/var/lib/flame/data:/app/data/"
-      ];
-    };
-  };
-
-  services.nginx.virtualHosts."${domain}" = {
-    locations."/".proxyPass = "http://${host}:${port}";
-  };
-}
-

hosts/defiant/services/gitea.nix

@@ -44,7 +44,7 @@ in {
 
         ui = {
           THEMES="gitea,arc-green,nord";
-          DEFAULT_THEME="nord";
+          #DEFAULT_THEME="nord";
         };
       };
 

hosts/defiant/services/home-assistant.nix

@@ -8,9 +8,10 @@ in {
 
   virtualisation.oci-containers.containers = {
     homeassistant = {
-      image = "ghcr.io/home-assistant/home-assistant:2024.1";
+      image = "ghcr.io/home-assistant/home-assistant:2025.5.3";
       extraOptions = [
         "--network=host"
+        "--device=/dev/ttyUSB0" # Sonoff Zigbee 3.0 USB
       ];
       volumes = [
         "/tank/services/homeassistant/config:/config"

hosts/defiant/services/keycloak.nix

@@ -1,6 +1,7 @@
 { config, pkgs, lib, ... }:
 let
   cfg = config.services.keycloak.settings;
+  hostname = "iam.feal.no";
 in {
   sops.secrets."keycloak/postgres" = { };
 
@@ -16,17 +17,17 @@ in {
 
     settings = {
       cache = "local";
-      hostname = "iam.feal.no";
-      hostname-strict-backchannel = true;
-      http-enable = true;
+      hostname = "https://${hostname}";
+      hostname-backchannel-dynamic = false;
+      http-enabled = true;
       http-host = "127.0.1.2";
       http-port = 5060;
-      proxy = "edge";
+      proxy-headers = "xforwarded";
     };
   };
 
   # The main reverse proxy is defined in ./nginx.nix
-  services.nginx.virtualHosts.${cfg.hostname} = {
-    locations."= /".return = "302 https://${cfg.hostname}/realms/feal.no/account";
+  services.nginx.virtualHosts.${hostname} = {
+    locations."= /".return = "302 ${cfg.hostname}/realms/feal.no/account";
   };
 }

hosts/defiant/services/matrix/synapse.nix

@@ -75,6 +75,8 @@
       tls_certificate_path = "/etc/ssl-snakeoil/matrix_feal_no.crt";
       tls_private_key_path = "/etc/ssl-snakeoil/matrix_feal_no.key";
 
+      enableSlidingSync = true;
+
       oidc_providers = [
         {
           idp_id = "keycloak";
@@ -82,10 +84,14 @@
           issuer = "https://iam.feal.no/realms/feal.no";
           client_id = "matrix-synapse";
           client_secret_path = config.sops.secrets."matrix/synapse/oidcsecret".path;
-          user_mapping_provicer.config = {
+          user_mapping_provider.config = {
             localpart_template = "{{ user.preferred_username }}";
             display_name_template = "{{ user.name }}";
           };
+          attribute_requirements = [{
+            attribute = "matrix-roles";
+            value = "matrix-user";
+          }];
           backchannel_logout_enabled = true;
           enable_registration = false;
         }
@@ -93,10 +99,10 @@
     };
   };
 
-  services.postgresqlBackup.databases = [ "matrix-synapse" ];
-
   services.redis.servers."".enable = true;
 
+  services.postgresqlBackup.databases = [ "matrix-synapse" ];
+
   services.nginx.virtualHosts."matrix.feal.no" = {
     listen = [
       { addr = "192.168.10.175"; port = 43443; ssl = true; }

hosts/defiant/services/minecraft/home.nix

@@ -0,0 +1,50 @@
+{ config, pkgs, lib, inputs, ... }:
+{
+  imports = [ inputs.nix-minecraft.nixosModules.minecraft-servers ];
+  nixpkgs.overlays = [ inputs.nix-minecraft.overlay ];
+
+  services.minecraft-servers = {
+    enable = true;
+    eula = true;
+    openFirewall = true;
+    dataDir = "/var/lib/minecraft-server";
+
+    servers.home = {
+      enable = true;
+      jvmOpts = "-Xms4G -Xmx4G";
+
+      package = pkgs.fabricServers.fabric-1_21_4;
+
+      serverProperties = {
+        motd = "Home <3";
+        difficulty = "easy";
+        view-distance = 16;
+        simulation-distance = 16;
+        enable-command-block = true;
+        enable-rcon = true;
+        online-mode = false;
+        "rcon.password" = "wack";
+      };
+
+      symlinks = {
+        mods = pkgs.linkFarmFromDrvs "mods" (builtins.attrValues {
+          FabricAPI = pkgs.fetchurl {
+            url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/8FAH9fuR/fabric-api-0.114.2%2B1.21.4.jar";
+            sha256 = "sha256-nL1bcAaMW0tRCpfW0prd3mce14ZNcl7pAUabVXAQfWs=";
+          };
+          Lithium = pkgs.fetchurl {
+            url = "https://cdn.modrinth.com/data/gvQqBUqZ/versions/zVOQw7YU/lithium-fabric-0.14.6%2Bmc1.21.4.jar";
+            sha256 = "sha256-iF4hy+3XVJP7Fv6R2dsrYq6Ct0MQJLX4/4Yh5WEJm90=";
+          };
+        });
+      };
+    };
+  };
+
+  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+    "minecraft-server"
+  ];
+
+  networking.firewall.allowedUDPPorts = [ 24454 ];
+}
+

hosts/defiant/services/monitoring/prometheus.nix

@@ -17,14 +17,12 @@ in {
         static_configs = [
           {
             targets = [
-              "burnham.home.feal.no:9100"
               "challenger.home.feal.no:9100"
               "defiant.home.feal.no:9100"
-              "edison.home.feal.no:9100"
-              "malcolm.home.feal.no:9100"
-              "mccoy.home.feal.no:9100"
+              "leonard.home.feal.no:9100"
+              "morn.home.feal.no:9100"
               "scotty.home.feal.no:9100"
-              "sulu.home.feal.no:9100"
+              "sisko.home.feal.no:9100"
             ];
           }
         ];

hosts/defiant/services/nginx.nix

@@ -54,6 +54,7 @@ in {
       '';
     } // overrides;
   in {
+    "amalie.mansaker.no" = publicProxy "http://leonard.home.feal.no/" { };
     "cloud.feal.no" = publicProxy "" {
       locations."/" = {
         proxyPass = "http://challenger.home.feal.no";
@@ -62,9 +63,11 @@ in {
         '';
       };
     };
-    "git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" {};
-    "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" {};
-    "iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" {};
-    "music.feal.no" = publicProxy "http://challenger.home.feal.no/" {};
+    "feal.no" = publicProxy "http://leonard.home.feal.no/" { serverAliases = [ "www.feal.no" ]; };
+    "git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" { default = true; };
+    "iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" { };
+    "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" { };
+    "kinealbrigtsen.no" = publicProxy "http://leonard.home.feal.no/" { serverAliases = [ "www.kinealbrigtsen.no" ]; };
+    "wiki.wackattack.eu" = publicProxy "http://leonard.home.feal.no/" { };
   };
 }

hosts/defiant/services/postgresql.nix

@@ -2,17 +2,24 @@
 {
   services.postgresql = {
     enable = true;
-    enableTCPIP = false;
+    enableTCPIP = true;
+
+    authentication = ''
+      host all all 172.16.0.0/12 md5
+    '';
   };
 
   services.postgresqlBackup = {
     enable = true;
-    location = "/data/backup/postgresql/";
+    location = "/tank/backup/postgresql";
     startAt = "*-*-* 03:15:00";
 
     # Each service is registered in its own configuration file
     databases = [ ];
   };
 
+  # Docker containers on this host can reach postgres
+  networking.firewall.extraCommands = "iptables -A INPUT -p tcp --destination-port 5432 -s 172.16.0.0/12 -j ACCEPT";
+
   environment.systemPackages = [ config.services.postgresql.package ];
 }

hosts/defiant/services/searx.nix

@@ -0,0 +1,39 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.searx;
+  domain = "search.home.feal.no";
+in {
+  services.searx = {
+    enable = true;
+    environmentFile = config.sops.secrets."searx/envfile".path;
+    settings = {
+      server = {
+        secret_key = "@SEARX_SECRET_KEY@";
+        base_url = "http://${domain}";
+      };
+    };
+
+    runInUwsgi = true;
+    uwsgiConfig = {
+      socket = "/run/searx/searx.sock";
+      chmod-socket = "660";
+    };
+
+    redisCreateLocally = true;
+  };
+
+  sops.secrets."searx/envfile" = {
+    owner = "searx";
+    group = "searx";
+  };
+
+  users.groups."searx".members = [ "nginx" ];
+
+  services.nginx.virtualHosts."${domain}" = {
+    locations."/".extraConfig = ''
+      include ${config.services.nginx.package}/conf/uwsgi_params;
+      uwsgi_pass unix:${cfg.uwsgiConfig.socket};
+    '';
+  };
+}
+

hosts/defiant/services/wireguard.nix

@@ -30,39 +30,9 @@ in {
             "10.100.0.2/32"
             "192.168.11.0/24"
           ];
-          endpoint = "site2.feal.no:51902";
+          #endpoint = "site2.feal.no:51902";
         }
-        { # Sulu
-          publicKey = "j6YVekgGS4nhL5zUiOTeK2BVQkYGlTQaiUpwcqQyfRk=";
-          allowedIPs = [
-            "10.100.0.3/32"
-          ];
-        }
-        { # Worf
-          publicKey = "kW8SyzCh2tw8GzZV6bPn+IQVNUoUhseNfEm3rHnR1So=";
-          allowedIPs = [
-            "10.100.0.4/32"
-          ];
-        }
-        { # Phone
-          publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk=";
-          allowedIPs = [
-            "10.100.0.5/32"
-          ];
-        }
-        { # Riker
-          publicKey = "r715vpgH1H0zvN+Z5wcNKcOo5e6UM3fBfh9BZwTBjmA=";
-          allowedIPs = [
-            "10.100.0.6/32"
-          ];
-        }
-        { # Work-laptop
-          publicKey = "px4YstB16lFjgdLQkH55wz8gQRupX/LTxg8dNFijDTA=";
-          allowedIPs = [
-            "10.100.0.7/32"
-          ];
-        }
-      ];
+      ] ++ (import ../../../common/wireguard-peers.nix);
     };
   };
 }

hosts/fa-t14-2025/configuration.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ../../base.nix
+      ./hardware-configuration.nix
+
+      ./desktop.nix
+  ];
+
+  networking = {
+    networkmanager.enable = true;
+    wireguard.enable = true;
+
+    tempAddresses = "disabled";
+    hostName = "fa-t14-2025";
+    nameservers = [ "9.9.9.9" ];
+    domain = "it.hime.no";
+    hostId = "f458d6aa";
+
+    search = [
+      "mktv.no"
+      "mktv.local"
+    ];
+  };
+
+  services.openssh.openFirewall = false;
+
+  environment.systemPackages = with pkgs; [
+    inetutils
+    wireguard-tools
+  ];
+
+  virtualisation.docker = {
+    enable = true;
+    rootless = {
+      enable = true;
+      setSocketVariable = true;
+    };
+  };
+
+  users.users.felixalb = {
+    uid = 1000;
+    openssh.authorizedKeys.keys = [ ];
+    extraGroups = [ "networkmanager" ];
+  };
+
+  console.keyMap = "no";
+
+  nixpkgs.config = {
+    allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+      "securecrt"
+      "securefx"
+    ];
+  };
+
+  system.stateVersion = "25.05";
+}

hosts/fa-t14-2025/desktop.nix

@@ -0,0 +1,51 @@
+{ config, pkgs, lib, ... }:
+{
+  hardware.graphics.enable = true;
+  services.xserver = {
+    enable = true;
+    xkb = {
+      options = "ctrl:nocaps";
+      layout = "no";
+    };
+  };
+  services.displayManager.ly.enable = true;
+  services.gnome.gnome-keyring.enable = true;
+
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+  };
+
+  # Audio
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
+
+  # Fonts
+  fonts = {
+    fontDir.enable = true;
+    packages = with pkgs; [
+      noto-fonts
+      noto-fonts-color-emoji
+      noto-fonts-cjk-sans
+      font-awesome
+      fira-code
+      hack-font
+      nerd-fonts.hack
+    ];
+  };
+
+  # Misc:
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+  };
+  location.provider = "geoclue2";
+  security.polkit.enable = true;
+  services.dbus.packages = [ pkgs.gcr ];
+  services.openssh.settings.X11Forwarding = true;
+  programs.nm-applet.enable = true;
+}

hosts/fa-t14-2025/hardware-configuration.nix

@@ -0,0 +1,51 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+  boot.kernelParams = [ "resume_offset=3037184" "mem_sleep_default=deep" ];
+  boot.resumeDevice = "/dev/disk/by-uuid/75dd0e39-9411-48c9-822d-bf3c897d0f61";
+
+  powerManagement.enable = true;
+  services.power-profiles-daemon.enable = true;
+  services.logind.lidSwitch = "suspend-then-hibernate";
+  services.logind.lidSwitchDocked = "ignore";
+  services.logind.powerKey = "suspend-then-hibernate";
+  services.logind.powerKeyLongPress = "poweroff";
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/75dd0e39-9411-48c9-822d-bf3c897d0f61";
+      fsType = "ext4";
+    };
+
+  boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-uuid/3ecaedab-415c-4cce-a3a9-9f3782acb682";
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/0800-59D9";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+    swapDevices = [
+      {
+        device = "/var/lib/swapfile";
+        size = 32*1024;
+      }
+    ];
+
+  networking.useDHCP = lib.mkDefault false;
+  # networking.interfaces.enp1s0f0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/fa-t14-2025/home.nix

@@ -0,0 +1,99 @@
+{ pkgs, lib, ... }:
+let
+  emailAddress = "felix.albrigtsen@mktv.no";
+in {
+  imports = [
+    ./../../home/base.nix
+    ./../../home/alacritty.nix
+  ];
+
+  home.packages = with pkgs; [
+    bc
+    catimg
+    chromium
+    dig
+    element-desktop
+    hunspellDicts.en_US
+    hunspellDicts.nb_NO
+    iperf3
+    jq
+    libreoffice
+    mpv
+    oauth2ms
+    openssl
+    openvpn
+    pavucontrol
+    pwgen
+    traceroute
+    virt-manager
+    w3m
+    nixpkgs-2211.remmina
+
+    (unstable.microsoft-edge.overrideAttrs ({ installPhase ? "", ... }: {
+      installPhase = installPhase + ''
+        ln -s $out/bin/microsoft-edge $out/bin/microsoft-edge-stable
+      '';
+    }))
+
+    # Window Manager Extras
+    bibata-cursors
+    brightnessctl
+    cliphist
+    hyprcursor
+    hypridle
+    hyprlock
+    hyprpaper
+    hyprshot
+    nautilus
+    rofi-rbw-wayland
+    swaynotificationcenter
+    waybar
+    wl-clipboard
+
+    (python312.withPackages (ps: with ps; [
+      numpy
+      pycryptodome
+      requests
+    ]))
+  ];
+
+  programs = {
+    aerc = {
+      enable = true;
+      package = pkgs.aerc;
+    };
+    firefox.enable = true;
+    git.extraConfig.user.email = emailAddress;
+    rbw = {
+      enable = true;
+      settings = {
+        base_url = "https://vault.mktv.no";
+        email = emailAddress;
+        pinentry = pkgs.pinentry-rofi;
+      };
+    };
+    rofi = {
+      enable = true;
+      # theme = "iggy";
+      theme = "Arc-Dark";
+    };
+    zsh = {
+      shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
+      prezto.pmodules = [ "ssh" ];
+    };
+  };
+
+  xdg.mimeApps = {
+    enable = true;
+
+    defaultApplications = {
+      "text/html" = "firefox.desktop";
+      "x-scheme-handler/http" = "firefox.desktop";
+      "x-scheme-handler/https" = "firefox.desktop";
+      "x-scheme-handler/about" = "firefox.desktop";
+      "x-scheme-handler/unknown" = "firefox.desktop";
+    };
+  };
+
+  home.stateVersion = "25.05";
+}

hosts/felixalbpc/configuration.nix

@@ -1,40 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports =
-    [
-      ../../base.nix
-      ./hardware-configuration.nix
-      ./desktop
-  ];
-
-  networking = {
-    interfaces.eno1 = {
-      useDHCP = true;
-      ipv6.addresses = [
-        { address = "2001:700:300:22::15"; prefixLength = 64; }
-      ];
-    };
-
-    tempAddresses = "disabled";
-    hostName = "felixalbpc";
-    nameservers = [ "129.241.0.200" "129.241.0.201" "2001:700:300::200" "2001:700:300::201" ];
-    domain = "it.ntnu.no";
-    hostId = "f458d6aa";
-  };
-
-  console.keyMap = "no";
-
-  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
-    "copilot.vim"
-  ];
-
-  users.users.felixalb = {
-    uid = 1328256;
-    extraGroups = [ "wheel" ];
-    openssh.authorizedKeys.keys = [ ];
-  };
-
-  system.stateVersion = "24.05";
-}
-

hosts/felixalbpc/desktop/default.nix

@@ -1,97 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  services.xserver = {
-    enable = true;
-    displayManager.gdm = {
-      enable = true;
-      wayland = true;
-    };
-    xkb = {
-      options = "ctrl:nocaps";
-      variant = "intl";
-      layout = "no,us";
-    };
-    windowManager.qtile.enable = true;
-  };
-
-  programs.hyprland.enable = true;
-
-  hardware.keyboard.zsa.enable = true;
-  environment.sessionVariables.NIXOS_OZONE_WL = "1";
-
-  home-manager.users.felixalb = {
-    services = {
-      dunst.enable = true;
-    };
-    home.packages = with pkgs; [
-      i3lock
-      libnotify
-      pamixer
-      pavucontrol
-      sxhkd
-      xclip
-      xss-lock
-    ];
-  };
-
-  hardware.opengl.enable = true;
-
-  # Audio
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    pulse.enable = true;
-    jack.enable = true;
-  };
-  hardware.pulseaudio.enable = false;
-
-  # Fonts
-  fonts = {
-    fontDir.enable = true;
-    packages = with pkgs; [
-      noto-fonts
-      noto-fonts-emoji
-      noto-fonts-cjk-sans
-      font-awesome
-      fira-code
-      hack-font
-      (nerdfonts.override {
-        fonts = [
-          "Hack"
-        ];
-      })
-    ];
-  };
-
-  # # Dark mode
-  # home-manager.users.felixalb = {
-  #   dconf.settings = {
-  #     "org/gnome/desktop/interface" = {
-  #       color-scheme = "prefer-dark";
-  #     };
-  #   };
-
-  #   gtk = {
-  #     enable = true;
-  #     theme = {
-  #       name = "Adwaita-dark";
-  #       package = pkgs.gnome.gnome-themes-extra;
-  #     };
-  #   };
-  # };
-
-  # qt = {
-  #   enable = true;
-  #   platformTheme = "gnome";
-  #   style = "adwaita-dark";
-  # };
-
-  # Misc:
-  xdg.portal = {
-    enable = true;
-    wlr.enable = true;
-  };
-  location.provider = "geoclue2";
-  security.polkit.enable = true;
-  services.openssh.settings.X11Forwarding = true;
-}

hosts/felixalbpc/hardware-configuration.nix

@@ -1,35 +0,0 @@
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  boot.initrd.luks.devices."cryptlvm".device = "/dev/disk/by-uuid/7516ebdb-14c3-4cb5-9d06-5e9d0e34b798";
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/02ac773e-31ff-4579-ad9a-859ba74f2a9e";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/77ED-720D";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-label/swap"; }
-    ];
-
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/felixalbpc/home.nix

@@ -1,56 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  imports = [
-    ./../../home/base.nix
-    ./../../home/alacritty.nix
-  ];
-
-  home.packages = with pkgs; [
-    catimg
-    chromium
-    dante
-    dig
-    element-desktop
-    jq
-    maim
-    mpv
-    oauth2ms
-    openssl
-    openstackclient
-    pwgen
-    remmina
-    w3m
-
-    (python311.withPackages (ps: with ps; [
-      numpy
-      pycryptodome
-      python-novaclient
-      requests
-    ]))
-  ];
-
-  programs = {
-    aerc.enable = true;
-    alacritty.enable = true;
-    firefox.enable = true;
-    git.extraConfig.user.email = "felix.albrigtsen@ntnu.no";
-    rofi.enable = true;
-    zsh.shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
-
-    neovim.plugins = with pkgs.vimPlugins; [ copilot-vim ];
-  };
-
-  xdg.mimeApps = {
-    enable = true;
-
-    defaultApplications = {
-      "text/html" = "firefox.desktop";
-      "x-scheme-handler/http" = "firefox.desktop";
-      "x-scheme-handler/https" = "firefox.desktop";
-      "x-scheme-handler/about" = "firefox.desktop";
-      "x-scheme-handler/unknown" = "firefox.desktop";
-    };
-  };
-
-  home.stateVersion = "24.05";
-}

hosts/leonard/configuration.nix

@@ -0,0 +1,53 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ../../base.nix
+      ../../common/metrics-exporters.nix
+      ../../common/auto-upgrade.nix
+      ./hardware-configuration.nix
+
+      ./services/mysql.nix
+      ./services/nginx.nix
+      ./services/postgresql.nix
+
+      ./services/wiki-wackattack-eu.nix
+      ./services/www-feal-no
+      ./services/www-kinealbrigtsen-no.nix
+      ./services/www-amalie-mansaker-no
+  ];
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub.enable = true;
+  boot.loader.grub.device = "/dev/sda";
+
+
+  networking = {
+    hostName = "leonard";
+    defaultGateway = "192.168.10.1";
+    interfaces.ens18.ipv4 = {
+      addresses = [
+        { address = "192.168.10.207"; prefixLength = 24; }
+      ];
+    };
+    hostId = "b99c12d1";
+
+    # Prepend the following output rules to disallow talking to other devices on LAN
+    firewall.extraCommands = lib.strings.concatLines ([
+      "iptables -F OUTPUT"
+    ] ++ (map (addr: "iptables -A OUTPUT -p udp --dport 53 -d ${addr} -j nixos-fw-accept") config.networking.nameservers) ++ [ # Exception for DNS
+      "iptables -A OUTPUT -p tcp --dport 3100 -d 192.168.10.175 -j nixos-fw-accept" # Exception for loki logging
+      "iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
+      "iptables -A OUTPUT -d 192.168.10.0/24 -j nixos-fw-refuse"
+      "iptables -A OUTPUT -d 192.168.11.0/24 -j nixos-fw-refuse"
+    ]);
+  };
+
+  sops.defaultSopsFile = ../../secrets/leonard/leonard.yaml;
+
+  environment.variables = { EDITOR = "vim"; };
+
+  system.stateVersion = "25.05";
+}
+

hosts/leonard/hardware-configuration.nix

@@ -1,6 +1,3 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 
 {
@@ -14,17 +11,14 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/7240554f-d9d9-457a-91d5-c70c09d96595";
+    { device = "/dev/disk/by-uuid/4a70c1d5-9d72-4581-8f75-733b91c10669";
       fsType = "ext4";
     };
 
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/88C2-BAC8";
-      fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
-    };
+  swapDevices = [ ]; # TODO
 
-  swapDevices = [ ];
+  networking.useDHCP = lib.mkDefault false;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/leonard/home.nix

@@ -8,5 +8,5 @@
     zsh.shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
   };
 
-  home.stateVersion = "23.05";
+  home.stateVersion = "25.05";
 }

hosts/leonard/services/postgresql.nix

@@ -0,0 +1,20 @@
+{ config, pkgs, lib, ... }:
+{
+  services.postgresql = {
+    enable = true;
+    enableTCPIP = false;
+    authentication = pkgs.lib.mkOverride 10 ''
+      #type database  DBuser  auth-method
+      local all       all     trust
+    '';
+  };
+
+  services.postgresqlBackup = {
+    enable = true;
+    location = "/backup/postgresql/";
+    startAt = "*-*-* 03:15:00";
+    backupAll = true;
+  };
+
+  environment.systemPackages = [ config.services.postgresql.package ];
+}

hosts/leonard/services/wiki-wackattack-eu.nix

@@ -0,0 +1,38 @@
+{ config, ... }:
+let
+  bindIP = "127.0.1.2";
+  port = 5051;
+  cfg = config.services.wiki-js;
+in {
+  # sops.secrets."wikijs/envfile" = {
+  #   restartUnits = [ "wiki-js.service" ];
+  # };
+
+  services.wiki-js = {
+    enable = true;
+    # environmentFile = config.sops.secrets."wikijs/envfile".path;
+    settings = {
+      inherit bindIP port;
+      db = {
+        type = "postgres";
+        host = "/run/postgresql";
+        db = "wiki-js";
+        user = "wiki-js";
+      };
+    };
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ "wiki-js" ];
+    ensureUsers = [{
+      name = "wiki-js";
+      ensureDBOwnership = true;
+    }];
+  };
+
+  services.nginx.virtualHosts."wiki.wackattack.eu" = {
+    locations."/" = {
+      proxyPass = "http://${bindIP}:${toString port}";
+    };
+  };
+}

hosts/leonard/services/www-amalie-mansaker-no/default.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, lib, ... }:
+
+{
+  services.nginx.virtualHosts."amalie.mansaker.no" = let
+    siteContent = pkgs.callPackage ./site.nix { };
+  in {
+    locations = {
+      "/".root = siteContent;
+    };
+  };
+}

hosts/leonard/services/www-amalie-mansaker-no/site.nix

@@ -0,0 +1,26 @@
+{ stdenv, fetchgit, hugo }:
+stdenv.mkDerivation {
+  name = "www-amalie-mansaker-no";
+
+  src = fetchgit {
+    url = "https://git.feal.no/amalieem/amalie.mansaker.no.git";
+    fetchSubmodules = true;
+
+    rev = "58265a25b37bf2286e0704e02ab3dde56a348d8b";
+    hash = "sha256-dPcv0AGjsWqDCWCjV2PeklBrWsIawLAccRQEYe3teOM=";
+  };
+
+  nativeBuildInputs = [ hugo ];
+  buildPhase = ''
+    cp -r $src/* .
+    ${hugo}/bin/hugo
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out
+    cp -r public/* $out/
+    runHook postInstall
+  '';
+}
+

hosts/leonard/services/www-feal-no/default.nix

@@ -0,0 +1,26 @@
+{ config, pkgs, lib, ... }:
+
+{
+  services.nginx.virtualHosts."feal.no" = {
+    default = true;
+
+    serverAliases = [
+      "www.feal.no"
+    ];
+
+    locations = {
+      # TODO: Reinstate actual website
+      "/".return = "302 https://git.feal.no/";
+
+      "^~ /.well-known/" = {
+        alias = (toString ./well-known) + "/";
+      };
+
+      "/cc/" = {
+        alias = "${pkgs.cyberchef}/share/cyberchef/";
+        index = "index.html";
+      };
+      "= /cc".return = "302 /cc/";
+    };
+  };
+}

hosts/leonard/services/www-feal-no/well-known/matrix/client

@@ -0,0 +1,5 @@
+{
+	"m.homeserver": {
+		"base_url": "https://matrix.feal.no:443"
+	}
+}

hosts/leonard/services/www-feal-no/well-known/matrix/server

@@ -0,0 +1 @@
+{"m.server": "matrix.feal.no:443"}

hosts/leonard/services/www-kinealbrigtsen-no.nix

@@ -83,7 +83,6 @@
       set_real_ip_from 192.168.11.0/24;
       real_ip_header X-Forwarded-For;
 
-      add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
       add_header 'Referrer-Policy' 'origin-when-cross-origin';
       add_header X-Frame-Options DENY;
       add_header X-Content-Type-Options nosniff;

hosts/malcolm/configuration.nix

@@ -1,47 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-
-    ../../base.nix
-    ../../common/metrics-exporters.nix
-
-    ./services/mysql.nix
-    ./services/nginx.nix
-    ./services/www-kinealbrigtsen-no.nix
-  ];
-
-  networking = {
-    hostName = "malcolm";
-    bridges.br0.interfaces = [ "ens18" ];
-    interfaces.br0.useDHCP = false;
-    interfaces.br0.ipv4.addresses = [
-      { address = "192.168.11.106"; prefixLength = 24; }
-    ];
-
-    hostId = "620c42d0";
-    defaultGateway = "192.168.11.1";
-
-    # Prepend the following output rules to disallow talking to other devices on LAN
-    firewall.extraCommands = lib.strings.concatLines ([
-      "iptables -F OUTPUT"
-    ] ++ (map (addr: "iptables -A OUTPUT -p udp --dport 53 -d ${addr} -j nixos-fw-accept") config.networking.nameservers) ++ [ # Exception for DNS
-      "iptables -A OUTPUT -p tcp --dport 3100 -d 192.168.10.175 -j nixos-fw-accept" # Exception for loki logging
-      "iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"
-      "iptables -A OUTPUT -d 192.168.10.0/24 -j nixos-fw-refuse"
-      "iptables -A OUTPUT -d 192.168.11.0/24 -j nixos-fw-refuse"
-    ]);
-  };
-
-  # virtualisation.oci-containers.backend = "docker";
-  # systemd.services.docker.postStart = lib.concatMapStringsSep "\n" (rule: "${pkgs.iptables}/bin/iptables ${rule}") ([
-  #   "-F DOCKER-USER"
-  # ] ++ (map (addr: "-A DOCKER-USER -p udp --dport 53 -d ${addr} -j RETURN") config.networking.nameservers) ++ [
-  #   "-A DOCKER-USER -d 192.168.10.0/24 -j REJECT"
-  #   "-A DOCKER-USER -d 192.168.11.0/24 -j REJECT"
-  #   "-A DOCKER-USER -j RETURN"
-  # ]);
-
-  system.stateVersion = "24.05";
-}

hosts/morn/configuration.nix

@@ -0,0 +1,35 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ../../base.nix
+      ../../common/metrics-exporters.nix
+      ../../common/auto-upgrade.nix
+      ./hardware-configuration.nix
+
+      ./services/nginx.nix
+
+      ./services/glance
+      ./services/miniflux.nix
+      ./services/thelounge.nix
+  ];
+
+  networking = {
+    hostName = "morn";
+    defaultGateway = "192.168.10.1";
+    interfaces.ens18.ipv4 = {
+      addresses = [
+        { address = "192.168.10.203"; prefixLength = 24; }
+      ];
+    };
+    hostId = "89b7722d";
+  };
+
+  sops.defaultSopsFile = ../../secrets/morn/morn.yaml;
+
+  environment.variables = { EDITOR = "vim"; };
+
+  system.stateVersion = "24.11";
+}
+

hosts/morn/hardware-configuration.nix

@@ -1,3 +1,6 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 
 {
@@ -11,20 +14,24 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/31ff6d37-52d6-43c3-a214-5d38a6c38b0e";
+    { device = "/dev/disk/by-uuid/93307186-cbc3-4748-859f-0013a1e36def";
       fsType = "ext4";
     };
 
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/cce59ee7-7c83-4165-a9b0-f950cd2e3273"; }
-    ];
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/FFCD-993A";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
   # still possible to use this option, but it's recommended to use it in conjunction
   # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  #networking.useDHCP = lib.mkDefault true;
+  # networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
 
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/morn/home.nix

@@ -8,5 +8,5 @@
     zsh.shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
   };
 
-  home.stateVersion = "24.05";
+  home.stateVersion = "24.11";
 }

hosts/morn/services/glance/default.nix

@@ -0,0 +1,15 @@
+{ config, values, ... }:
+{
+  services.glance = {
+    enable = true;
+    settings = import ./settings.nix;
+  };
+
+  services.nginx.virtualHosts."glance.home.feal.no" = let
+    inherit (config.services.glance.settings.server) host port;
+  in {
+    locations."/" = {
+      proxyPass = "http://${host}:${toString port}";
+    };
+  };
+}

hosts/morn/services/glance/settings.nix

@@ -0,0 +1,83 @@
+{ config, ... }:
+
+{
+  server = {
+    port = 5001;
+    host = "127.0.1.2";
+  };
+
+  pages =
+    let
+      fullCol = widgets: {
+        size = "full";
+        inherit widgets;
+      };
+    in
+    [
+      {
+        name = "Home";
+        columns = [
+          (fullCol [
+            {
+              type = "search";
+              search-engine = "http://search.home.feal.no/search?q={QUERY}";
+            }
+            {
+              type = "weather";
+              units = "metric";
+              location = "Trondheim, Norway";
+            }
+          ])
+          (fullCol [
+            {
+              type = "hacker-news";
+              limit = 20;
+              collapse-after = 5;
+            }
+            {
+              type = "monitor";
+              cache = "5m";
+              sites =
+                let
+                  site = title: url: { inherit title url; };
+                in
+                [
+                  (site "Jellyfin" "http://jellyfin.home.feal.no")
+                  (site "Gitea" "https://git.feal.no")
+                  (site "VaultWarden" "https://pw.feal.no")
+                ];
+            }
+          ])
+        ];
+      }
+
+      {
+        name = "News";
+        columns =
+          let
+            feed = title: url: { inherit title url; };
+            rss = title: feeds: {
+              type = "rss";
+              inherit title feeds;
+            };
+          in
+          [
+            (fullCol [
+              (rss "Norway" [
+                (feed "NRK" "https://www.nrk.no/toppsaker.rss")
+                (feed "Bygdeposten" "https://www.bygdeposten.no/service/rss")
+                (feed "Nidaros" "https://www.nidaros.no/service/rss")
+              ])
+            ])
+
+            (fullCol [
+              (rss "NTNU" [
+                (feed "OmegaV" "https://omegav.no/newsrss")
+                (feed "PVV" "https://www.pvv.ntnu.no/w/api.php?hidebots=1&urlversion=1&days=7&limit=50&action=feedrecentchanges&feedformat=atom")
+                (feed "IT-Varsel" "https://varsel.it.ntnu.no/subscribe/rss/")
+              ])
+            ])
+          ];
+      }
+    ];
+}

hosts/morn/services/miniflux.nix

@@ -0,0 +1,23 @@
+{ config, pkgs, lib, ... }:
+let
+  domain = "rss.home.feal.no";
+  listen_addr = "127.0.1.2:5051";
+in {
+  sops.secrets."miniflux/env" = { };
+
+  services.miniflux = {
+    enable = true;
+    adminCredentialsFile = config.sops.secrets."miniflux/env".path;
+    config = {
+      CREATE_ADMIN = true;
+
+      LISTEN_ADDR = listen_addr;
+      BASE_URL = "http://${domain}";
+    };
+  };
+
+  services.nginx.virtualHosts."${domain}" = {
+    locations."/".proxyPass = "http://${listen_addr}";
+  };
+}
+

hosts/morn/services/nginx.nix

@@ -2,8 +2,7 @@
 {
   services.nginx = {
     enable = true;
-
-    clientMaxBodySize = "100m";
+    enableReload = true;
 
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
@@ -12,4 +11,9 @@
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "felix@albrigtsen.it";
+  };
 }

hosts/sisko/configuration.nix

@@ -0,0 +1,90 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ../../base.nix
+      ../../common/metrics-exporters.nix
+      ./hardware-configuration.nix
+      ./desktop.nix
+  ];
+
+  networking = {
+    hostName = "sisko";
+    # networkmanager.enable = true;
+    defaultGateway = "192.168.10.1";
+    interfaces.enp14s0 = {
+      ipv4 = {
+        addresses = [
+          { address = "192.168.10.172"; prefixLength = 24; }
+        ];
+      };
+      wakeOnLan.enable = true;
+    };
+    hostId = "b716d781";
+  };
+
+  hardware.bluetooth.enable = true;
+  hardware.rtl-sdr.enable = true;
+  sops.defaultSopsFile = ../../secrets/sisko/sisko.yaml;
+  environment.variables = { EDITOR = "vim"; };
+
+  users.users.felixalb.extraGroups = [
+    "dialout"
+    "libvirtd"
+    "networkmanager"
+    "plugdev"
+  ];
+
+  programs = {
+    alvr = {
+      enable = true;
+      openFirewall = true;
+    };
+
+    firefox = {
+      enable = true;
+      nativeMessagingHosts.packages = with pkgs; [ tridactyl-native ];
+    };
+
+    gamemode.enable = true;
+
+    immersed.enable = true;
+
+    steam = {
+      enable = true;
+      remotePlay.openFirewall = true;
+    };
+
+    virt-manager.enable = true;
+  };
+
+  virtualisation = {
+    libvirtd.enable = true;
+    spiceUSBRedirection.enable = true;
+  };
+
+  environment.systemPackages = with pkgs; [
+    virtiofsd
+  ];
+
+  virtualisation.docker.enable = true;
+  virtualisation.oci-containers.backend = "docker";
+
+  nixpkgs.config = {
+    allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [
+      "discord"
+      "immersed"
+      "spotify"
+      "steam"
+      "steam-unwrapped"
+    ];
+    permittedInsecurePackages = [
+      "openssl-1.1.1w"
+    ];
+    rocmSupport = true;
+  };
+
+  services.fwupd.enable = true;
+  system.stateVersion = "24.11";
+}

hosts/sisko/desktop.nix

@@ -0,0 +1,70 @@
+{ config, pkgs, lib, ... }:
+{
+  # Video
+  hardware.graphics = {
+    enable = true;
+    enable32Bit = true;
+  };
+  hardware.amdgpu.opencl.enable = true;
+  services.displayManager.ly.enable = true;
+  services.xserver.enable = true;
+
+  services.xserver.desktopManager.xfce.enable = true;
+
+  programs.hyprland = {
+    enable = true;
+    xwayland.enable = true;
+  };
+
+  # Audio
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    pulse.enable = true;
+    jack.enable = true;
+  };
+
+  # Misc
+  fonts = {
+    fontDir.enable = true;
+    packages = with pkgs; [
+      fira-code
+      font-awesome
+      hack-font
+      nerd-fonts.hack
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-color-emoji
+    ];
+  };
+
+  environment.sessionVariables = {
+    NIXOS_OZONE_WL = "1";
+    SSH_AUTH_SOCK = "/run/user/${toString config.users.users.felixalb.uid}/keyring/ssh";
+  };
+
+  services.gnome.gnome-keyring.enable = true;
+
+  # Dark mode
+  home-manager.users.felixalb = {
+    dconf.settings = {
+      "org/gnome/desktop/interface" = {
+        color-scheme = "prefer-dark";
+      };
+    };
+
+    gtk = {
+      enable = true;
+      theme = {
+        name = "Adwaita-dark";
+        package = pkgs.gnome-themes-extra;
+      };
+    };
+  };
+
+  qt = {
+    enable = true;
+    platformTheme = "gnome";
+    style = "adwaita-dark";
+  };
+}

hosts/sisko/hardware-configuration.nix

@@ -0,0 +1,55 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+  boot.extraModprobeConfig = "options bluetooth disable_ertm=1"; # Xbox controller
+  hardware.xpadneo.enable = true;
+
+  boot.kernel.sysctl = {
+    "vm.max_map_count" = 16777216;
+    # "fs.file-max" = 524288;
+  };
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/60a70caf-ca37-488d-8c2a-98a7e9b67d84";
+      fsType = "btrfs";
+      options = [ "subvol=root" ];
+    };
+
+  fileSystems."/nix" =
+    { device = "/dev/disk/by-uuid/60a70caf-ca37-488d-8c2a-98a7e9b67d84";
+      fsType = "btrfs";
+      options = [ "subvol=nix" ];
+    };
+
+  fileSystems."/home" =
+    { device = "/dev/disk/by-uuid/60a70caf-ca37-488d-8c2a-98a7e9b67d84";
+      fsType = "btrfs";
+      options = [ "subvol=home" ];
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/12CE-A600";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ {
+    device = "/swapfile";
+    size = 64*1024;
+  } ];
+
+  networking.useDHCP = lib.mkDefault false;
+  # networking.interfaces.enp14s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp15s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/sisko/home.nix

@@ -0,0 +1,162 @@
+{ pkgs, lib, config, ... }:
+
+{
+  imports = [
+    ./../../home/base.nix
+    ./../../home/alacritty.nix
+  ];
+
+  home.packages = with pkgs; [
+    # GUI Applications
+    cantata
+    chromium
+    discord
+    easyeffects
+    element-desktop
+    emacs-gtk
+    feishin
+    gqrx
+    kitty
+    libreoffice
+    lutris
+    mpv
+    mumble
+    orca-slicer
+    papers
+    pavucontrol
+    picard
+    pkgsRocm.hashcat
+    prismlauncher
+    restic
+    runelite
+    spotify
+    swayimg
+    thunderbird
+    tor-browser
+    bolt-launcher
+
+    exiftool
+    ghidra
+    # pwndbg-gdb-alias # Broken in 25.05
+    snicat
+
+    # Window Manager Extras
+    bibata-cursors
+    cliphist
+    hyprcursor
+    hypridle
+    hyprlock
+    hyprpaper
+    hyprshot
+    nautilus
+    networkmanager
+    rofi-rbw-wayland
+    swaynotificationcenter
+    waybar
+    wl-clipboard
+
+    # Misc tools
+    abcde
+    bc
+    catimg
+    dante
+    dig
+    go
+    hunspellDicts.en_US
+    hunspellDicts.nb_NO
+    jq
+    nixpkgs-2211.remmina
+    ollama-rocm
+    openssl
+    playerctl
+    pwgen
+    restic
+    rocmPackages.clang
+    traceroute
+    w3m
+
+    (python313.withPackages (ps: with ps; [
+      numpy
+      pycryptodome
+      requests
+    ]))
+  ];
+
+  programs = {
+    aerc = {
+      enable = true;
+      package = pkgs.aerc;
+    };
+    alacritty = {
+      enable = true;
+      settings.window.opacity = 0.92;
+    };
+    ncmpcpp.enable = true;
+    rbw = {
+      enable = true;
+      settings = {
+        base_url = "https://pw.feal.no";
+        email = "felix@albrigtsen.it";
+        pinentry = pkgs.pinentry-gnome3;
+      };
+    };
+    rofi = {
+      enable = true;
+      theme = "iggy";
+    };
+    zsh = {
+      shellAliases."rebuild" = "sudo nixos-rebuild switch --flake /config";
+      prezto.pmodules = [ "ssh" ];
+    };
+  };
+
+  services = {
+    mpd = let
+      home = config.home.homeDirectory;
+    in {
+      enable = true;
+      musicDirectory = "${home}/mnt/music";
+      dataDir = "${home}/Music/mpd/data";
+      playlistDirectory = "${home}/Music/mpd/playlists";
+      extraConfig = ''
+        audio_output {
+          type "pipewire"
+          name "PipewireOut1"
+        }
+      '';
+    };
+  };
+
+  home.pointerCursor = {
+    name = "Bibata-Modern-Ice";
+    package = pkgs.bibata-cursors;
+    size = 24;
+    gtk.enable = true;
+    x11 = {
+      enable = true;
+      defaultCursor = true;
+    };
+  };
+
+  xdg.mimeApps = {
+    enable = true;
+
+    defaultApplications = {
+      "text/html" = "firefox.desktop";
+      "x-scheme-handler/http" = "firefox.desktop";
+      "x-scheme-handler/https" = "firefox.desktop";
+      "x-scheme-handler/about" = "firefox.desktop";
+      "x-scheme-handler/unknown" = "firefox.desktop";
+
+      "inode/directory" = "org.gnome.Nautilus.desktop";
+      "application/pdf" = "org.gnome.Papers.desktop";
+
+    } // builtins.listToAttrs (
+      builtins.map
+        ( imgType: { name = "image/${imgType}"; value = "swayimg.desktop"; } )
+        [ "apng" "bmp" "gif" "heic" "heif" "jpeg" "png" "svg" "svg+xml" "tiff" ]
+    );
+  };
+
+  home.stateVersion = "24.11";
+}

hosts/voyager/backup.nix

@@ -1,47 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  services.borgbackup.jobs =
-    let
-      borgJob = name: {
-        environment.BORG_RSH = "ssh -i /root/.ssh/fealsyn1";
-        environment.BORG_REMOTE_PATH = "/usr/local/bin/borg";
-        repo = "ssh://backup@feal-syn1.home.feal.no/volume2/backup/borg/voyager/${name}";
-        compression = "auto,zstd";
-      };
-    in {
-      postgresDaily = borgJob "postgres::daily" // {
-        paths = "/var/backup/postgres";
-        startAt = "*-*-* 05:15:00"; # 2 hours after postgresqlBackup
-        extraInitArgs = "--storage-quota 10G";
-        encryption = {
-          mode = "repokey-blake2";
-          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
-        };
-      };
-
-      postgresWeekly = borgJob "postgres::weekly" // {
-        paths = "/var/backup/postgres";
-        startAt = "Mon *-*-* 05:15:00"; # 2 hours after postgresqlBackup
-        extraInitArgs = "--storage-quota 10G";
-        encryption = {
-          mode = "repokey-blake2";
-          passCommand = "cat ${config.sops.secrets."borg/postgres".path}";
-        };
-      };
-
-      transmission = borgJob "transmission::weekly" // {
-        paths = "/var/lib/transmission";
-        startAt = "weekly";
-        encryption = {
-          mode = "repokey-blake2";
-          passCommand = "cat ${config.sops.secrets."borg/transmission".path}";
-        };
-      };
-
-      # TODO: timemachine, nextcloud, komga, calibre
-
-    };
-
-  sops.secrets."borg/postgres" = { };
-  sops.secrets."borg/transmission" = { };
-}

hosts/voyager/configuration.nix

@@ -1,51 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports =
-    [
-      ../../base.nix
-      ../../common/metrics-exporters.nix
-      ./hardware-configuration.nix
-      ./backup.nix
-      ./exports.nix
-      ./filesystems.nix
-
-      ./services/fancontrol.nix
-      ./services/podgrab.nix
-      ./services/snappymail.nix
-      ./services/timemachine.nix
-  ];
-
-  networking = {
-    hostName = "voyager";
-    bridges.br0.interfaces = [ "eno1" ];
-    interfaces.br0.useDHCP = false;
-    interfaces.br0.ipv4.addresses = [
-      { address = "192.168.10.165"; prefixLength = 24; }
-    ];
-
-    hostId = "8e84b235";
-    defaultGateway = "192.168.10.1";
-  };
-
-  sops.defaultSopsFile = ../../secrets/voyager/voyager.yaml;
-
-  environment.variables = { EDITOR = "vim"; };
-  environment.systemPackages = with pkgs; [
-    zfs
-  ];
-
-  virtualisation.docker.enable = true;
-  virtualisation.oci-containers.backend = "docker";
-
-  users.users."amalieem" = {
-    isNormalUser = true;
-    home = "/home/amalieem";
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID7e+BAoXIFmTeeBYAVImQAcyx6SCoYCErA7h16OGL70 amalieem@wentworth"
-    ];
-  };
-
-  system.stateVersion = "22.11";
-}
-

hosts/voyager/exports.nix

@@ -1,27 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  fileSystems = {
-    "/export/riker-backup" = {
-      device = "/tank/backup/riker";
-      options = [ "bind" ];
-    };
-    "/export/defiant-backup" = {
-      device = "/tank/backup/defiant";
-      options = [ "bind" ];
-    };
-  };
-
-  # Enable nfs4 only
-  services.nfs.server = {
-    enable = true;
-    exports = ''
-      /export                   192.168.10.4(rw,fsid=0,no_subtree_check) 192.168.10.5(rw,fsid=0,no_subtree_check) 192.168.10.2(rw,fsid=0,no_subtree_check) 192.168.10.175(rw,fsid=0,no_subtree_check)
-      /export/riker-backup      192.168.10.2(rw,nohide,no_subtree_check,no_root_squash)
-      /export/doyle-backup      192.168.10.2(rw,nohide,no_subtree_check,no_root_squash)
-      /export/defiant-backup    192.168.10.175(rw,nohide,no_subtree_check,async,no_root_squash)
-    '';
-  };
-
-  networking.firewall.allowedTCPPorts = [ 111 2049 20048 ];
-  networking.firewall.allowedUDPPorts = [ 111 20048];
-}

hosts/voyager/filesystems.nix

@@ -1,42 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # Boot drives are defined in ./hardware-configuration.nix
-
-  environment.systemPackages = with pkgs; [ cifs-utils ];
-
-  # Local zfs
-  boot = {
-    zfs.extraPools = [ "tank" ];
-    supportedFilesystems = [ "zfs" ];
-    kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-  };
-  services.zfs.autoScrub = {
-    enable = true;
-    interval = "Wed *-*-8..14 00:00:00";
-  };
-
-  # Network mounts (import)
-  fileSystems = {
-    "/mnt/feal-syn1/media" = {
-      device = "feal-syn1.home.feal.no:/volume2/media";
-      fsType = "nfs";
-      options = [ "vers=3" ];
-      #options = [ "x-systemd.automount" "noauto" ];
-    };
-    "/mnt/feal-syn1/nfs_proxmox" = {
-      device = "//feal-syn1.home.feal.no/nfs_proxmox";
-      fsType = "cifs";
-      options = let
-        # this line prevents hanging on network split
-        automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
-
-      in ["${automount_opts},credentials=/etc/feal-syn1-credentials"];
-    };
-
-    "/var/backup" = {
-      device = "/tank/backup/voyager";
-      options = [ "bind "];
-    };
-  };
-
-}

hosts/voyager/hardware-configuration.nix

@@ -1,38 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "mpt3sas" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/a6465c1c-4c93-423d-84a9-e4ecb9520741";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/D0C1-97CE";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno2.useDHCP = lib.mkDefault true;
-  # networking.interfaces.idrac.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/voyager/modules/snappymail.nix

@@ -1,102 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  inherit (lib) mkDefault mkEnableOption mkForce mkIf mkOption mkPackageOption generators types;
-
-  cfg = config.services.snappymail;
-  maxUploadSize = "256M";
-in {
-  options.services.snappymail = {
-    enable = mkEnableOption "Snappymail";
-
-    package = mkPackageOption pkgs "snappymail" { };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "/var/lib/snappymail";
-      description = "State directory for snappymail";
-    };
-
-    hostname = mkOption {
-      type = types.nullOr types.str;
-      default = null;
-      example = "mail.example.com";
-      description = "Enable nginx with this hostname, null disables nginx";
-    };
-
-    user = mkOption {
-      type = types.str;
-      default = "snappymail";
-      description = "System user under which snappymail runs";
-    };
-
-    group = mkOption {
-      type = types.str;
-      default = "snappymail";
-      description = "System group under which snappymail runs";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users = mkIf (cfg.user == "snappymail") {
-      snappymail = {
-        description = "Snappymail service";
-        group = cfg.group;
-        home = cfg.dataDir;
-        isSystemUser = true;
-      };
-    };
-
-    users.groups = mkIf (cfg.group == "snappymail") {
-      snappymail = {};
-    };
-
-    services.phpfpm.pools.snappymail = {
-      user = cfg.user;
-      group = cfg.group;
-      phpOptions = generators.toKeyValue {} {
-        upload_max_filesize = maxUploadSize;
-        post_max_size = maxUploadSize;
-        memory_limit = maxUploadSize;
-      };
-
-      settings = {
-        "listen.owner" = config.services.nginx.user;
-        "listen.group" = config.services.nginx.group;
-        "pm" = "ondemand";
-        "pm.max_children" = 32;
-        "pm.process_idle_timeout" = "10s";
-        "pm.max_requests" = 500;
-      };
-    };
-
-    services.nginx = mkIf (cfg.hostname != null) {
-      virtualHosts."${cfg.hostname}" = {
-        locations."/".extraConfig = ''
-          index index.php;
-          autoindex on;
-          autoindex_exact_size off;
-          autoindex_localtime on;
-        '';
-        locations."^~ /data".extraConfig = ''
-          deny all;
-        '';
-        locations."~ \\.php$".extraConfig = ''
-          include ${config.services.nginx.package}/conf/fastcgi_params;
-
-          fastcgi_param   SCRIPT_FILENAME $document_root$fastcgi_script_name;
-          fastcgi_pass unix:${config.services.phpfpm.pools.snappymail.socket};
-        '';
-        extraConfig = ''
-          client_max_body_size ${maxUploadSize};
-        '';
-
-        root = if (cfg.package == pkgs.snappymail) then
-          pkgs.snappymail.override {
-            dataPath = cfg.dataDir;
-          }
-        else cfg.package;
-      };
-    };
-  };
-}

hosts/voyager/services/fancontrol.nix

@@ -1,63 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  systemd.timers."fancontrol" = {
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar="*:0/3";
-      Unit = "fancontrol.service";
-    };
-  };
-
-  systemd.services."fancontrol" = {
-    environment = {
-      TEMP_MIN_FALLING = "50";
-      TEMP_MAX_RISING = "56";
-      TEMP_CRIT = "70";
-
-      LOW_FAN_SPEED = "0x10";
-    };
-
-    script = ''
-      SET_FAN_MANUAL="0x30 0x30 0x01 0x00" # Enable manual control
-      SET_FAN_AUTO="0x30 0x30 0x01 0x01" # Disable manual control
-
-      SET_FAN_LOW="0x30 0x30 0x02 0xff $LOW_FAN_SPEED"
-      SET_FAN_MAX="0x30 0x30 0x02 0xff 0x64" # force 100%
-
-
-      # Get all temperatures readings starting with "Temp ", find all two digit numbers followed by spaces, find the largest one, trim the trailing space
-      maxcoretemp=$(${pkgs.ipmitool}/bin/ipmitool sdr type temperature | grep '^Temp ' |  grep -Po '\d{2} ' | sort -nr | head -n1 | xargs)
-
-      # Verify that we read a valid number
-      ISNUMBER='^[0-9]+$'
-      if ! [[ $maxcoretemp =~ $ISNUMBER ]] ; then
-        echo "Error: could not read temperature" >&2
-        exit 2
-      fi
-
-      echo "Highest measured CPU temperature: '$maxcoretemp'"
-
-      if [ "$maxcoretemp" -gt "$TEMP_CRIT" ]; then
-        echo "TOO HOT, CRITICAL CPU TEMP"
-        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_MANUAL
-        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_MAX
-        exit 1
-      fi
-
-      if [ "$maxcoretemp" -gt "$TEMP_MAX_RISING" ]; then
-        echo "TOO HOT, switching to IDRAC fan controL"
-        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_AUTO
-        exit 0
-      fi
-
-      if [ "$maxcoretemp" -lt "$TEMP_MIN_FALLING" ]; then
-        echo "Sufficiently cooled, stepping down fans"
-        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_MANUAL
-        ${pkgs.ipmitool}/bin/ipmitool raw $SET_FAN_LOW
-        exit 0
-      fi
-
-      echo "Temperature is between limits, doing nothing..."
-    '';
-  };
-}

hosts/voyager/services/podgrab.nix

@@ -1,22 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.services.podgrab;
-  domain = "podgrab.home.feal.no";
-in {
-  sops.secrets."podgrab/password" = { };
-
-  services.podgrab = {
-    enable = true;
-    port = 5104;
-    passwordFile = config.sops.secrets."podgrab/password".path;
-  };
-
-  services.nginx.virtualHosts.${domain} = {
-    locations."/".proxyPass = "http://localhost:${toString cfg.port}";
-  };
-
-  fileSystems."/tank/media/jellyfin/Podcasts" = {
-    device = "/var/lib/podgrab/data";
-    options = [ "bind "];
-  };
-}

hosts/voyager/services/snappymail.nix

@@ -1,17 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  imports = [ ../modules/snappymail.nix ];
-
-  services.snappymail = {
-    enable = true;
-    hostname = "mail.home.feal.no";
-  };
-  services.nginx.virtualHosts."${config.services.snappymail.hostname}" = let
-    certPath = "/etc/ssl-snakeoil/home.feal.no";
-  in {
-    addSSL = true;
-
-    sslCertificate    = "${certPath}.crt";
-    sslCertificateKey = "${certPath}.key";
-  };
-}

hosts/voyager/vms.nix

@@ -1,10 +0,0 @@
-{ config, pkgs, lib, ... }:
-{
-  # WIP
-  security.polkit.enable = true; # Required for libvirt
-  virtualisation.libvirtd.enable = true;
-  programs.dconf.enable = true;
-  environment.systemPackages = with pkgs; [ virt-manager ];
-  users.users.felixalb.extraGroups = [ "libvirtd" ];
-}
-

hosts/worf/configuration.nix

@@ -8,6 +8,8 @@
   nixpkgs.config.allowUnfree = true;
 
   nix = {
+    enable = true;
+
     # gc = {
     #   automatic = true;
     #   options = "--delete-older-than 2d";
@@ -15,7 +17,7 @@
 
     settings = {
       allow-dirty = true;
-      experimental-features = [ "nix-command" "flakes" "repl-flake" ];
+      experimental-features = [ "nix-command" "flakes" ];
       builders-use-substitutes = true;
       extra-platforms = [ "x86_64-darwin" "aarch64-darwin" ];
       log-lines = 50;
@@ -33,6 +35,17 @@
         supportedFeatures = [ "kvm" "big-parallel" "benchmark" "nixos-test" ];
         mandatoryFeatures = [ ];
 
+        sshUser = "felixalb";
+        sshKey = "/var/root/.ssh/nix-builder";
+      }
+      {
+        hostName = "challenger.home.feal.no";
+        system = "x86_64-linux";
+
+        maxJobs = 6;
+        supportedFeatures = [ "kvm" "big-parallel" "benchmark" "nixos-test" ];
+        mandatoryFeatures = [ ];
+
         sshUser = "felixalb";
         sshKey = "/var/root/.ssh/nix-builder";
       }
@@ -50,6 +63,7 @@
       gnugrep
       jq
       nix-output-monitor
+      nixpkgs-review
       ripgrep
       skhd
       sshfs
@@ -62,6 +76,8 @@
     };
   };
 
+  ids.gids.nixbld = 30000;
+  system.primaryUser = "felixalb";
   users.users.felixalb = {
     home = "/Users/felixalb";
     shell = pkgs.zsh;
@@ -72,16 +88,11 @@
 
 
   fonts.packages = with pkgs; [
-    noto-fonts
-    font-awesome
     fira-code
+    font-awesome
     hack-font
-
-    (nerdfonts.override {
-      fonts = [
-        "Hack"
-      ];
-    })
+    nerd-fonts.hack
+    noto-fonts
   ];
 
   system.defaults = {
@@ -100,14 +111,6 @@
     };
 
 
-    # firewall settings
-    alf = {
-      # 0 = disabled 1 = enabled 2 = blocks all connections except for essential services
-      globalstate = 1;
-      loggingenabled = 0;
-      stealthenabled = 1;
-    };
-
     # dock settings
     dock = {
       autohide = true;
@@ -123,12 +126,16 @@
     };
   };
 
+  # firewall settings
+  networking.applicationFirewall = {
+    enable = true;
+    blockAllIncoming = true;
+  };
+
   system.keyboard = {
     enableKeyMapping = true;
     remapCapsLockToControl = true;
   };
 
-  # Auto upgrade nix package and the daemon service.
-  services.nix-daemon.enable = true;
-  nix.package = pkgs.nix;
+  system.stateVersion = 5;
 }

hosts/worf/home.nix

@@ -11,42 +11,48 @@
   ];
 
   home.packages = with pkgs; [
-    emacs-macport
-    feishin
-    iterm2
-    # prismlauncher
-    spotify
-
     aerc
-    borgbackup
+    bore-cli
     catimg
     cocoapods
+    emacs-macport
+    feishin
     gnutar
+    iterm2
+    mosh
+    mpv
     nix-index
     nodejs
+    prismlauncher
+    restic
+    snicat
+    # spotify # TODO - broken in 25.11
     tldr
-    unstable.snicat
     w3m
     zellij
 
     (python311.withPackages (ps: with ps; [
-      pwntools
-      pycryptodome
+      # pwntools
+      # pycryptodome
       requests
     ]))
   ];
 
   programs.zsh = {
-    shellAliases."rebuild" = "darwin-rebuild switch --flake /Users/felixalb/nix";
+    shellAliases."rebuild" = "sudo darwin-rebuild switch --flake /Users/felixalb/nix";
     prezto.pmodules = [ "ssh" ];
   };
 
   programs.neovim.plugins = with pkgs.vimPlugins; [
+    coc-clangd
     coc-emmet
-    copilot-vim
     emmet-vim # Ctrl+y + ,
   ];
 
+  xdg.configFile = {
+    "sketchybar".source = ./sketchybar;
+  };
+
   # Copy Applications to ~/Applications to allow them to be launched from Spotlight
   disabledModules = [ "targets/darwin/linkapps.nix" ];
   home.activation = lib.mkIf pkgs.stdenv.isDarwin {
@@ -55,7 +61,7 @@
         apps = pkgs.buildEnv {
           name = "home-manager-applications";
           paths = config.home.packages;
-          pathsToLink = "/Applications";
+          pathsToLink = [ "/Applications" ] ;
         };
       in
       lib.hm.dag.entryAfter [ "writeBoundary" ] ''

hosts/worf/sketchybar/colors.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+# Color Palette
+export BLACK=0xff181926
+export WHITE=0xffcad3f5
+export RED=0xffed8796
+export GREEN=0xffa6da95
+export BLUE=0xff8aadf4
+export YELLOW=0xffeed49f
+export ORANGE=0xfff5a97f
+export MAGENTA=0xffc6a0f6
+export GREY=0xff939ab7
+export TRANSPARENT=0x00000000
+
+# General bar colors
+export BAR_COLOR=0xe62e2e2e
+export BAR_BORDER_COLOR=0xff494d64 #0xa024273a
+export ICON_COLOR=$WHITE # Color of all icons
+export LABEL_COLOR=$WHITE # Color of all labels
+export BACKGROUND_1=0x603c3e4f
+export BACKGROUND_2=0x60494d64
+
+export POPUP_BACKGROUND_COLOR=0xff1e1e2e
+export POPUP_BORDER_COLOR=$WHITE
+
+export SHADOW_COLOR=$BLACK

hosts/worf/sketchybar/icons.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+
+# General Icons
+LOADING=􀖇
+APPLE=􀣺
+PREFERENCES=􀺽
+ACTIVITY=􀒓
+LOCK=􀒳
+BELL=􀋚
+BELL_DOT=􀝗
+
+# Git Icons
+GIT_ISSUE=􀍷
+GIT_DISCUSSION=􀒤
+GIT_PULL_REQUEST=􀙡
+GIT_COMMIT=􀡚
+GIT_INDICATOR=􀂓
+
+# Spotify Icons
+SPOTIFY_BACK=􀊎
+SPOTIFY_PLAY_PAUSE=􀊈
+SPOTIFY_NEXT=􀊐
+SPOTIFY_SHUFFLE=􀊝
+SPOTIFY_REPEAT=􀊞
+
+# Yabai Icons
+YABAI_STACK=􀏭
+YABAI_FULLSCREEN_ZOOM=􀏜
+YABAI_PARENT_ZOOM=􀥃
+YABAI_FLOAT=􀢌
+YABAI_GRID=􀧍
+
+# Battery Icons
+BATTERY_100=􀛨
+BATTERY_75=􀺸
+BATTERY_50=􀺶
+BATTERY_25=􀛩
+BATTERY_0=􀛪
+BATTERY_CHARGING=􀢋
+
+# Volume Icons
+VOLUME_100=􀊩
+VOLUME_66=􀊧
+VOLUME_33=􀊥
+VOLUME_10=􀊡
+VOLUME_0=􀊣
+
+# WiFi
+WIFI_CONNECTED=􀙇
+WIFI_DISCONNECTED=􀙈
+
+# svim
+MODE_NORMAL=􀂯
+MODE_INSERT=􀂥
+MODE_VISUAL=􀂿
+MODE_CMD=􀂙
+MODE_PENDING=􀈏

hosts/worf/sketchybar/icons_nerdfont.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+# General Icons
+LOADING=
+APPLE=󰘳
+PREFERENCES=
+ACTIVITY=
+LOCK=
+BELL=
+BELL_DOT=
+
+# Spotify Icons
+SPOTIFY_BACK=􀊎
+SPOTIFY_PLAY_PAUSE=􀊈
+SPOTIFY_NEXT=􀊐
+SPOTIFY_SHUFFLE=􀊝
+SPOTIFY_REPEAT=􀊞
+
+# Yabai Icons
+YABAI_STACK=
+YABAI_FULLSCREEN_ZOOM=
+YABAI_PARENT_ZOOM=
+YABAI_FLOAT=󰥛
+YABAI_GRID=󰋁
+
+# Battery Icons
+BATTERY_100=󱈏
+BATTERY_75=󰂀
+BATTERY_50=󰁾
+BATTERY_25=󰁻
+BATTERY_0=󱉝
+BATTERY_CHARGING=󰂄
+
+# Volume Icons
+VOLUME_100=
+VOLUME_66=󰕾
+VOLUME_33=󰖀
+VOLUME_10=󰕿
+VOLUME_0=
+
+# WiFi
+WIFI_CONNECTED=󰖩
+WIFI_DISCONNECTED=󱚵

hosts/worf/sketchybar/items/apple.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+POPUP_OFF='sketchybar --set apple.logo popup.drawing=off'
+POPUP_CLICK_SCRIPT='sketchybar --set $NAME popup.drawing=toggle'
+
+apple_logo=(
+  icon=$APPLE
+  icon.font="$FONT:Black:16.0"
+  icon.color=$GREEN
+  padding_right=15
+  label.drawing=off
+  click_script="$POPUP_CLICK_SCRIPT"
+  popup.height=35
+)
+
+apple_prefs=(
+  icon=$PREFERENCES
+  label="Preferences"
+  click_script="open -a 'System Preferences'; $POPUP_OFF"
+)
+
+apple_activity=(
+  icon=$ACTIVITY
+  label="Activity"
+  click_script="open -a 'Activity Monitor'; $POPUP_OFF"
+)
+
+apple_lock=(
+  icon=$LOCK
+  label="Lock Screen"
+  click_script="pmset displaysleepnow; $POPUP_OFF"
+)
+
+sketchybar --add item apple.logo left                  \
+           --set apple.logo "${apple_logo[@]}"         \
+                                                       \
+           --add item apple.prefs popup.apple.logo     \
+           --set apple.prefs "${apple_prefs[@]}"       \
+                                                       \
+           --add item apple.activity popup.apple.logo  \
+           --set apple.activity "${apple_activity[@]}" \
+                                                       \
+           --add item apple.lock popup.apple.logo      \
+           --set apple.lock "${apple_lock[@]}"

hosts/worf/sketchybar/items/battery.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+battery=(
+  script="$PLUGIN_DIR/battery.sh"
+  icon.font="$FONT:Regular:19.0"
+  padding_right=5
+  padding_left=0
+  label.drawing=off
+  update_freq=120
+  updates=on
+)
+
+sketchybar --add item battery right      \
+           --set battery "${battery[@]}" \
+           --subscribe battery power_source_change system_woke

hosts/worf/sketchybar/items/calendar.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+calendar=(
+  icon=cal
+  icon.font="$FONT:Black:12.0"
+  icon.padding_right=0
+  label.width=45
+  label.align=right
+  padding_left=15
+  update_freq=30
+  script="$PLUGIN_DIR/calendar.sh"
+  click_script="$PLUGIN_DIR/zen.sh"
+)
+
+sketchybar --add item calendar right       \
+           --set calendar "${calendar[@]}" \
+           --subscribe calendar system_woke

hosts/worf/sketchybar/items/cpu.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+
+cpu_top=(
+  label.font="$FONT:Bold:7"
+  label=CPU
+  icon.drawing=off
+  width=0
+  padding_right=15
+  y_offset=6
+)
+
+cpu_percent=(
+  label.font="$FONT:Bold:12"
+  label=CPU
+  y_offset=-4
+  padding_right=15
+  width=55
+  icon.drawing=off
+  update_freq=4
+  mach_helper="$HELPER"
+)
+
+cpu_sys=(
+  width=0
+  graph.color=$RED
+  graph.fill_color=$RED
+  label.drawing=off
+  icon.drawing=off
+  background.height=30
+  background.drawing=on
+  background.color=$TRANSPARENT
+)
+
+cpu_user=(
+  graph.color=$BLUE
+  label.drawing=off
+  icon.drawing=off
+  background.height=30
+  background.drawing=on
+  background.color=$TRANSPARENT
+)
+
+sketchybar --add item cpu.top right              \
+           --set cpu.top "${cpu_top[@]}"         \
+                                                 \
+           --add item cpu.percent right          \
+           --set cpu.percent "${cpu_percent[@]}" \
+                                                 \
+           --add graph cpu.sys right 75          \
+           --set cpu.sys "${cpu_sys[@]}"         \
+                                                 \
+           --add graph cpu.user right 75         \
+           --set cpu.user "${cpu_user[@]}"